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JOINT OVERSIGHT HEARING ON 
MANAGING COSTS AND MITIGATING DELAYS 
IN THE BUILDING OF SOCIAL SECURITY’S 
NEW NATIONAL COMPUTER CENTER 


FRIDAY, FEBRUARY 11, 2011 

U.S. House of Representatives, 
Committee on Ways and Means, 

Washington, DC. 

The subcommittees met, pursuant to call, at 10:05 a.m., in Room 
1100, Longworth House Office Building, the Honorable Sam John- 
son [Chairman of the Subcommittee on Social Security, Committee 
on Ways and Means] presiding. 

[The advisory of the hearing follows:] 


( 1 ) 
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HEARING ADVISORY 

FROM THE COMMITTEE ON WAYS AND MEANS 

Chairman Johnson and Chairman Denham 
Announce a Joint Oversight Hearing on 
Managing Costs and Mitigating Delays 
in the Building of Social Security’s 
New National Computer Center 

February 4, 2011 

U.S. Congressman Sam Johnson (R-TX), Chairman of the House Committee on 
Ways and Means Subcommittee on Social Security, and U.S. Congressman Jeff 
Denham (R-CA), Chairman of the House Committee on Transportation and Infra- 
structure Subcommittee on Economic Development, Public Buildings, and Emer- 
gency Management, announced today that the Subcommittees will hold a joint over- 
sight hearing on managing costs and mitigating delays in the building of the Social 
Security Administration’s (SSA’s) new National Computer Center (NCC). The hear- 
ing will take place on Friday, February 11, 2011 in 1100 Longworth House 
Office Building, beginning at 10:00 a.m. 

In view of the limited time available to hear witnesses, oral testimony at this 
hearing will be from invited witnesses only. However, any individual or organization 
not scheduled for an oral appearance may submit a written statement for consider- 
ation by the Committee and for inclusion in the printed record of the hearing. A 
list of invited witnesses will follow. 

BACKGROUND : 

Information technology ( IT ) is the foundation of the SSA’s ability to serve the pub- 
lic. Over the past decade, the SSA has migrated 95 percent of its workloads from 
a paper-based system to an electronic processing system. This year the IT infra- 
structure supports the payment of over $700 billion in benefits to 56 million people, 
completing an average of over 75 million business transactions per day. Along with 
maintaining earnings, benefit, and demographic information for most Americans, 
the SSA’s computers also house the electronic medical records of millions who have 
filed disability claims. In addition, over 1 billion data files are exchanged annually 
between the SSA, Federal, State, and local government agencies and businesses in 
order to administer Social Security benefits and other programs. 

Until January 2009, the SSA ran its nationwide computer operations from its Bal- 
timore-based 30-year old NCC. Since then, a second state-of-the-art support center 
now runs approximately 35 percent of all workloads and is able to recover all critical 
systems and restore services within 4 days should a catastrophic failure of the NCC 
occur. 

As time passes, the risk of a failure at the NCC is increasing due to its aging 
electrical and mechanical infrastructure. Should an NCC failure occur, lengthy serv- 
ice disruptions would severely affect service to the American public and cost tax- 
payers millions of dollars. 

In February 2009, the American Recovery and Reinvestment Act of 2009 provided 
$500 million for the SSA to replace the NCC, the single largest building project 
funded under the Act. The General Services Administration (GSA) and the SSA are 
managing the development and construction of the new project, including the devel- 
opment of requirements for the new center and site selection. The project remains 
on budget but the projected date for complete commissioning of the new facility has 
been delayed one year to January 2015. 
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In announcing the hearing, Chairman Sam Johnson (R-TX) stated, “Information 
technology is the most important element in driving Social Security to de- 
liver 21st century customer service. Taxpayers are investing in a $500 mil- 
lion upgrade and they will not tolerate cost overruns or further delays in 
another failed stimulus project. Neither will I.” 

“We need to hold the General Services Administration accountable for 
this half billion dollar project,” Chairman Jeff Denham (R-CA) stated. “The 
agency needs to use the resources they were provided, stay on budget and 
get this project back on schedule.” 

FOCUS OF THE HEARING : 

The hearing will focus on the progress made by the SSA and the GSA to replace 
the NCC, including progress to date and reasons for project delays. The Subcommit- 
tees will also assess how the SSA and the GSA plan to avoid further delays and 
stay within budget. Finally, the Subcommittees will examine the SSA’s prepared- 
ness should an NCC failure occur. 

DETAILS FOR SUBMISSION OF WRITTEN COMMENTS : 

Please Note: Any person(s) and/or organization(s) wishing to submit for the hear- 
ing record must follow the appropriate link on the hearing page of the Committee 
website and complete the informational forms. From the Committee homepage, 
http:llwaysandmeans.house.gov, select “Hearings.” Select the hearing for which you 
would like to submit, and click on the link entitled, “Click here to provide a submis- 
sion for the record.” Once you have followed the online instructions, submit all re- 
quested information. ATTACH your submission as a Word document, in compliance 
with the formatting requirements listed below, by the close of business on Fri- 
day, March 4, 2011. Finally, please note that due to the change in House mail pol- 
icy, the U.S. Capitol Police will refuse sealed-package deliveries to all House Office 
Buildings. For questions, or if you encounter technical problems, please call (202) 
225-1721 or (202) 225-3625. 

FORMATTING REQUIREMENTS : 

The Committee relies on electronic submissions for printing the official hearing 
record. As always, submissions will be included in the record according to the discre- 
tion of the Committee. The Committee will not alter the content of your submission, 
but we reserve the right to format it according to our guidelines. Any submission 
provided to the Committee by a witness, any supplementary materials submitted for 
the printed record, and any written comments in response to a request for written 
comments must conform to the guidelines listed below. Any submission or supple- 
mentary item not in compliance with these guidelines will not be printed, but will 
be maintained in the Committee files for review and use by the Committee. 

1. All submissions and supplementary materials must be provided in Word format and MUST 
NOT exceed a total of 10 pages, including attachments. Witnesses and submitters are advised 
that the Committee relies on electronic submissions for printing the official hearing record. 

2. Copies of whole documents submitted as exhibit material will not be accepted for printing. 
Instead, exhibit material should be referenced and quoted or paraphrased. All exhibit material 
not meeting these specifications will be maintained in the Committee files for review and use 
by the Committee. 

3. All submissions must include a list of all clients, persons and/or organizations on whose 
behalf the witness appears. A supplemental sheet must accompany each submission listing the 
name, company, address, telephone, and fax numbers of each witness. 

The Committee seeks to make its facilities accessible to persons with disabilities. 
If you are in need of special accommodations, please call 202-225-1721 or 202-226- 
3411 TTD/TTY in advance of the event (four business days notice is requested). 
Questions with regard to special accommodation needs in general (including avail- 
ability of Committee materials in alternative formats) may be directed to the Com- 
mittee as noted above. 
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Note: All Committee advisories and news releases are available on the World 
Wide Web at http://www.waysandmeans.house.gov / . 


Chairman JOHNSON. Good morning. Welcome to the first hear- 
ing of the Ways and Means Subcommittee on Social Security in the 
112th Congress. I especially want to welcome the new members of 
our subcommittee and our colleagues from the Committee on 
Transportation and Infrastructure, the Subcommittee on Economic 
Development, Public Buildings, and Emergency Management, espe- 
cially the new chairman, Jeff Denham, who is sitting right here. 

I also want to say how much I look forward to working with our 
new subcommittee ranking member and my good friend, Xavier 
Becerra. Thank you for being here. 

As our nation ages, more Americans are depending on Social Se- 
curity benefits and the services they paid for through their hard- 
earned wages. To deliver those benefits and services, Social Secu- 
rity needs technology that it can count on. 

Because I take technology needs of Social Security very seriously, 
last year I toured the National Computer Center in Baltimore, So- 
cial Security’s technological nerve center. This center allows the 
agency to process applications, pay benefits, and store secured data 
on most U.S. workers. Two weeks ago I also visited the second sup- 
port center in North Carolina. Yet, as we know, Social Security’s 
30-year-old National Computer Center is past its prime, and that 
is why the Congress authorized $500 million of taxpayer funds to 
build a new state-of-the-art data center. 

Just over a year ago, our subcommittees held a similar joint 
hearing to check in on Social Security’s and the General Services 
Administration’s progress. Back then we couldn’t get good an- 
swers — I hope we can today — as to why they decided to locate the 
new center away from Social Security’s headquarters in Baltimore, 
which I found out just this morning that they have over a couple 
hundred acres up there. So I don’t know still today why we couldn’t 
have found a place there. 

Now the project is already delayed a year, and that is before a 
single shovel has hit the ground. All the while, the more time 
passes, the higher the risk of the National Computer Center fail- 
ing. 

If any of you have ever been up there, it was a firetrap. And I 
think people fail to realize that if that place burned down, we 
would lose all our onsite Social Security records. That is why we 
built the second center down in North Carolina, which still hasn’t 
got the capability to come up immediately. 

While progress has been made, it would still take four days to 
restore critical operations, and that is not good enough, and Social 
Security knows it. Americans want, need, and deserve better, and 
today we will learn more about the plans to improve. 

Taxpayers are investing in a $500 million infrastructure up- 
grade. The last thing they deserve is another failed stimulus 
project due to further delays or future cost overruns. Social Secu- 
rity owes it to the American taxpayer to make good on this invest- 
ment. 
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Today we need to find out whether GSA and Social Security are 
doing everything they know how to do to make this project right 
and on time, if not ahead of time. This project should have started 
yesterday. And I want to thank all the witnesses in front of me for 
joining us today and presenting their expert testimony. 

I would like to at this time ask Ranking Member Becerra, would 
you care to make a statement, sir? You are recognized. 

Mr. BECERRA. Thank you, Mr. Chairman. 

This is a timely topic for our first hearing. I appreciate, Mr. 
Chairman, that you are continuing the tradition of this sub- 
committee of conducting bipartisan oversight of the Social Security 
Administration (SSA) in the interests of the American people. 

The new data center that SSA is constructing in conjunction with 
the GSA, the General Services Administration, is vitally important 
to the continued operation of the Social Security Administration. 
Today, 54 million people rely on SSA to keep America’s promises 
to all Americans and to deliver each month the money they have 
earned and expect from their Social Security system. They have 
contributed for years into the system from their own paychecks. 

In addition, 160 million workers rely on SSA to keep accurate 
records of their earnings so, in the future, they will receive the full 
benefits they too have earned. We know they will receive the bene- 
fits they have earned because their contributions over the years 
have built up a trust fund with over $2.6 trillion in Treasury 
bonds, the safest investment there is, sought after by investors 
throughout the world. Today it is not an exaggeration to say that 
Social Security, and the Social Security number, touch virtually 
every American in this country. 

I think we can all agree about the importance of this data center, 
the replacement project itself, and of course, everything it means 
to the American people. SSA’s existing primary data center is near- 
ing the end of its useful life and is increasingly vulnerable to cata- 
strophic failure. Congress acted wisely by responding swiftly to the 
needs for the replacement center by providing full funding for con- 
struction and a down payment on equipping the center in the Re- 
covery Act. 

This funding has allowed the project to get started immediately, 
which reduces the danger that SSA will be without full data center 
capability, and building the data center will create jobs that 
strengthen our economic recovery. I understand that there have 
been some delays in selecting a site for the new center, and I am 
pleased that things are once again moving ahead. 

I hope our witnesses will give us more information on the 
project’s timeline and budget, as well as their plans for preventing 
future delays. Keeping to project timelines is critical to ensuring 
that SSA can continue to effectively serve workers and bene- 
ficiaries today and in the future. 

I look forward to hearing a progress report on the project today. 
Mr. Chairman, I yield back. 

Chairman JOHNSON. Thank you, Mr. Becerra. 

Chairman Denham, welcome aboard. Congratulations. Would you 
like to make a statement this morning? You are recognized. 

Mr. DENHAM. Thank you. First let me start by thanking you, 
Mr. Chairman, for holding this joint hearing on managing costs 
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and mitigating delays in the building of the Social Security Admin- 
istration’s National Computer Center. 

This is the second joint hearing of our subcommittees. We have 
had to provide oversight of this important project. The National 
Computer Center is critical to supporting all of SSA’s functions, in- 
cluding storing data and processing billions of transactions annu- 
ally. 

The NCC must be reliable and operational 24/7, 365 days a year. 
However, the current data center is aging and outdated, lacking 
key redundancies and failing to meet current standards for data 
centers. 

The Recovery Act, which included the $500 million for the re- 
placement of the NCC in SSA has engaged GSA in locating, design- 
ing, and building a new data center. Millions of Americans and em- 
ployers rely upon the proper function of NCC every day. 

Unfortunately, only last week did GSA select a site, more than 
a year after the original date for site selection, and we know that 
delays often produce cost overruns. We must ensure this project is 
completed on time and within budget. We cannot afford any further 
slip in the timeline, and we cannot afford any added cost. The oper- 
ations of this data center are too critical for the American people, 
and this project is too costly, to allow any more delays. 

The GSA and SSA must work together to identify risks in the 
process and either avoid or mitigate against them. I look forward 
to hearing from the witnesses today on this important issue. As 
well, I look forward to hearing what is going to happen with the 
current facility and the 260 acres that it sits on. 

We will also be focused on liquidating any unused, excessive, or 
surplus properties and those properties which are not deemed ex- 
cess, surplus, or underutilized yet. We want to have a good track 
record moving forward. 

Thank you. 

Chairman JOHNSON. Thank you. I appreciate your comments. 

Ranking Member Holmes Norton, would you care to make a 
statement? You are recognized. 

Ms. NORTON. Thank you very much, Mr. Chairman. And I am 
pleased to sit with you, Mr. Chairman, and with our friends on the 
Ways and Means Social Security Subcommittee again to examine 
the process for replacing the Social Security Administration’s cur- 
rent data center. 

Today’s hearing is a followup to our December 15, 2009 hearing 
on whether to locate the NSC on the current campus in Woodlawn, 
Maryland or to ensure that a full and open competitive process is 
used for this significant project. The reason our subcommittee is 
here is that the Subcommittee on Economic Development, Public 
Buildings, and Emergency Management has jurisdiction over the 
General Services Administration now. 

This project was able to begin at all because it received $500 mil- 
lion in a direct appropriation to the Social Security Administration, 
so urgent was the need. And indeed, this is the largest single build- 
ing funded under the Recovery Act. 

GSA assists agencies in construction when they get direct appro- 
priations because these agencies are not in the business of building 
or developing. And we are pleased that GSA is indeed deeply in- 
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volved in this project. It is very, very rare that there is a direct ap- 
propriation to an agency rather than to the GSA in order to do the 
work for the agency because of its expertise. 

After our last joint hearing and at our request, GSA conducted 
a feasibility study of the Woodlawn campus that examined the 
budget and schedule risks the project might face staying on or leav- 
ing the Woodlawn campus. As a result of the feasibility study, the 
GSA and SSA decided on an offsite location — away from the cam- 
pus, that is — for the NSC because that option posed the least risk 
to both budget and schedule, they believe. 

The existing NCC, originally constructed in the 1970s, is housed 
in an antiquated building that is very energy-inefficient and other- 
wise in urgent need of replacement. A 2008 study commissioned by 
the SSA concluded that the NSC is an aging facility with signifi- 
cant electrical and mechanical challenges, including several single 
points of failure, that could force the NSC to point down should any 
of these points fail. 

This near-emergency situation requires GSA and SSA to stay on 
schedule. Both SSA and its inspector general believe that the 
present structure is inadequate to meet the service needs of a 21st 
century computer facility, and that it poses a significant risk to op- 
erations. In the present structure, the security of 460 million 
records of earnings and benefits data for almost 57 million bene- 
ficiaries and the continuity of operations are both at significant 
risk. 

After the decision was made to locate the NSC offsite, GSA nar- 
rowed the available sites to two locations, a new site in Woodlawn, 
Maryland and a site in Urbana, Maryland. Last week SSA and 
GSA notified Congress of their decision to locate the NSC at the 
Urbana, Maryland site 33 miles from SSA headquarters. 

The SSA IG believes that the site selected for NSC is acceptable 
because of its existing infrastructure and proximity to highways, 
although he apparently, in his latest report, has some compunc- 
tions. 

Today we will look closely at the site selected and will examine 
whether the critical project can stay on schedule and how GSA and 
SSA will mitigate risk. Among the most obvious questions is why 
GSA and SSA selected this site out of 150 sites that were initially 
considered, and why the agencies felt that this is the best side for 
the NSC. 

I look forward to learning more about this project from today’s 
witnesses, and I thank you, Mr. Chairman. 

Chairman JOHNSON. Thank you. 

Before we move on to our testimony, I want to remind our wit- 
nesses to limit their oral testimony to five minutes. And without 
objection, all written testimony will be made part of the permanent 
record. 

We have one panel today. Our witnesses are seated at the table: 
the Honorable Patrick O’Carroll, Inspector General of Social Secu- 
rity Administration — he made me coffee down in Carolina; David 
Foley, Deputy Commissioner of the Public Buildings Service, U.S. 
General Services Administration; and Kelly Croft, Deputy Commis- 
sioner, Systems, Social Security Administration. Thank you for 
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being here today, all three of you, and we appreciate your testi- 
mony. 

Mr. O’Carroll, you may proceed for five minutes. 

STATEMENT OF THE HONORABLE PATRICK P. O’CARROLL, JR., 
INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION 

Mr. O’CARROLL. Good morning, Chairman Johnson, Chairman 
Denham, Congresswoman Holmes Norton, Congressman Becerra, 
and members of both subcommittees. Thank you for the invitation 
to testify today. I would like to welcome the new members of the 
112th Congress and the new members of both subcommittees. 

The replacement of SSA’s National Computer Center, or NCC, is 
the agency’s most critical IT investment over the next five years. 
Several factors make building a new data center imperative for 
SSA. Those factors are: increasing agency workloads, expanding 
communication and data services, and structural and electrical ca- 
pacity issues at the current NCC. 

The NCC is more than 30 years old and might soon be unable 
to support SSA’s operations, and as time passes, the risk of a 
lengthy outage at the aging data center increases. An extended out- 
age at the NCC could have devastating consequences affecting the 
lives of Americans who depend on Social Security. 

Given the infrastructure concerns of the NCC, SSA has three 
main challenges to plan for over the next five years. Those chal- 
lenges are: delivering the agency’s new National Support Center, or 
NSC, on time; maintaining the current NCC with repairs and im- 
provements; and further developing reliable backup options if an 
extended NCC outage occurs. 

SSA and GSA recently announced it would locate the agency’s 
new NSC in Urbana, Maryland. GSA said it anticipates completing 
construction of the NSC by September 2014, and SSA expects to 
complete the IT migration of the facility by July 2016. 

For the project to be completed on time, GSA and SSA need to 
plan for contingencies that can arise during the construction and 
IT migration. Solutions to such contingencies should be determined 
in advance before the project stalls. These possible project delays 
might include: excavation challenges, problems with utility instal- 
lations, or weather-related issues. SSA and GSA must also ensure 
that builders meet construction due dates. 

SSA’s timeline for project completion means relying on the cur- 
rent NCC for at least another five years. Therefore, SSA must do 
all it can to mitigate the risk of an extended NCC outage. 

Since 2009, SSA has taken many steps to address the structural 
and technical issues at the NCC. Those actions include: replacing 
electrical feeder cables and electrical panel breakers; replacing the 
NCC roof; monitoring the building’s foundation, plumbing, and 
HVAC system; and performing annual building inspections with 
technical experts. SSA performs proper maintenance of the NCC. 
For the facility to be maintained through 2016, the same level of 
management and oversight should continue until the new NSC is 
built and operational. 

If the NCC sustains an outage before the new data center is com- 
pleted, the agency would then rely on the Second Support Center, 
or SSC, until data and applications are recovered. The SSC is a co- 
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processing center, but SSA has purchased equipment and is per- 
forming tests so the SSC will be able to operate as a fully func- 
tional backup data center within the next two years. 

Recent disaster recovery tests at the SSC show that SSA can re- 
cover critical operations in a little less than five days. Over the 
next year, the agency has said it plans to reduce that five-day pe- 
riod to about one day. 

SSA has also indicated it is exploring several options if an ex- 
tended outage occurs at the NCC, including using generators or en- 
tering into a contract with alternate hot-site vendor. 

In conclusion, the sustainability and expansion of SSA’s IT sys- 
tems are critical to the agency’s ability to meet its goals and fulfill 
its mission. That mission affects nearly all Americans every day. 
GSA and SSA need to present a clear strategic vision on how they 
will deliver the new data center on time and how to mitigate the 
risks of relying on the aging NCC. 

With long-term planning and proactive management, we should 
be able to avoid a repeat of the current situation at the NCC. My 
office will continue to work with you and SSA to make sure that 
this vitally important project is completed timely and efficiently. 

Thank you again for asking me to testify today, and I will be 
happy to answer questions. 

[The prepared statement of Mr. O’Carroll follows:] 
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Statement of the Honorable Patrick P. O’Carroll, Jr. 

Inspector General, Social Security Administration 

Testimony before the Subcommittee on Social Security 
of the House Committee on Ways and Means 
and the Subcommittee on Economic Development, Public Buildings, 
and Emergency Management 

of the House Committee on Transportation and Infrastructure 
February 11,2011 

Good morning, Mr. Chairman, Mr. Chairman, Mr. Becerra, Mrs. Holmes Norton, and members 
of both Subcommittees. I would like to welcome the new members of the 1 1 2 lh Congress, along 
with new members of both Subcommittees. It is a pleasure to appear before you, and I thank you 
for the invitation to testify today. I have appeared before the Subcommittee on Social Security 
many times to discuss issues critical to the Social Security Administration (SSA) and the services 
the Agency provides to American citizens. Today, we arc discussing SSA’s progress in 
constructing a replacement facility for its National Computer Center (NCC), SSA’s aging 
national computer processing and data storage facility. 

I last spoke to both Subcommittees about the replacement of the NCC at a hearing in December 
2009. At the time, there was much debate among the Subcommittees, SSA, and the General 
Services Administration (GSA) regarding the location of a new data center — on the grounds of 
SSA Headquarters in Woodlawn, Maryland, or at a location away from the Agency campus. 

After more than a year of consideration and discussion between GSA and SSA, the decision was 
made to locate the Agency’s new National Support Center (NSC) at the Urbana Research Center 
in Urbana, Maryland, just south of Frederick, Maryland. We understand that OMB has approved 
that site selection and that SSA finds it to be functionally acceptable. 

While SSA’s Office of the Inspector General (OIG) is pleased with the site selection for the 
NSC, it is a matter of some concern that GSA and SSA to this point have taken longer than 
anticipated to follow their timeline for the project. During the December 2009 hearing, GSA said 
it anticipated selecting and acquiring a site for the NSC in March 2010, with a design-build 
contract awarded in March 2011. According to GSA, the project will not be completed by its 
original target completion date of October 2013. 

The importance of the NCC to SSA’s operations cannot be understated. The NCC houses about 
460 million records of Americans' earnings, as well as current benefit data for about 57 million 
beneficiaries, supporting SSA programs provided to the public and other services provided to 
government agencies. Ensuring the continued operation of the NCC while properly planning for 
the transition to a new NSC is critical; were there an extended outage or another issue that 
caused the NCC to become unavailable, the Agency would be unable to process tens of 
thousands of retirement, survivor, and disability claims, as well as Social Security number 
verifications. This type of service interruption would severely affect the American public, 
delaying the delivery of benefits to citizens who depend on these funds in their day-to-day lives, 
and likely hindering people’s ability to obtain employment, driver’s licenses, and even loans and 
mortgages. 
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In recent years, we have called on SSA to develop a long-term overall information technology 
(IT) strategic plan, with a critical focus on the replacement of the NCC and the proper and timely 
transition to the NSC. In a September 2007 OIG report. The Social Security Administration 's 
Information Resources Management Strategic Plan, our office said, “Because SSA’s Information 
Resources Management (IRM) strategic planning docs not go beyond two years, its IRM docs 
not provide a clear strategic vision of what the Agency needs or plans to do over the next few 
years to address its critical challenges.” 

Tlie replacement of the NCC with the NSC is SSA’s most critical IT challenge over the next five 
years. The NCC, located at SSA Headquarters in Woodlawn, was constructed in 1979, and the 
building in which it is housed is nearing the end of its useful physical life. The chance of a 
potentially crippling outage at the NCC increases as time passes; an NCC feasibility study 
completed by Lockheed Martin in 2008 estimated the NCC would reach maximum capacity in 
three to five years. The effort to replace the NCC gained momentum when Congress passed and 
the President signed the American Recovery and Reinvestment Act of 2009 ( Recovery Act), which 
provided S500 million for SSA to replace the NCC. The OIG was provided $2 million for the 
oversight of SSA’s use of Recovery Act funds. We have said and maintain that swift and efficient 
planning for the replacement of the NCC is necessary for the Agency to provide benefits without 
delay to those who need and are entitled to them. 

While the planning for the construction of the NSC continues, there are risks involved in the 
ongoing reliance on the aging NCC to handle SSA’s daily operations. In its 2008 study, 

Lockheed Martin identified several structural and technical deficiencies with the NCC. Lockheed 
Martin identified, and SSA said it has taken action on, the following issues: 

• Lockheed Martin identified the NCC electrical feeder cables as the only point of imminent 
failure at the data center, as degraded insulation could potentially result in loss of power, 
leaving SSA with only batteries as a power source to potentially accomplish a controlled 
shutdown. In February 2009, SSA spent SI. 9 million to replace the deteriorating feeder 
cables between the Utility Building and the NCC. 

• In 2008, the NCC operated with an outdated electrical panel breaker design that violated 
safety codes and could have caused overheating or fire damage and resulted in a data center 
outage. On Lockheed Martin’s recommendation, SSA spent S2.7 million to replace the 
electrical panels over three NCC shutdowns between 2009 and 2010. SSA also increased the 
number of circuits of per panel, allowing for additional IT equipment growth and technology 
changes. 

• Lockheed Martin recommended SSA begin exploring options to address the overall risk of 
continuing to rely on a 30-year-old Uninterruptible Power Source (UPS), including extending 
its NCC maintenance contract through 2014. SSA said current terms of its maintenance 
contract will expire in September 2012, and the Agency plans to establish a new contract by 
that time that extends the maintenance service through 2018. 

However, as of January 201 1, SSA’s maintenance contractor stated its intent to provide NCC 
service through 2015, with a “Best Efforts” extension based on equipment available through 
2018. Because of the vagueness of the contractor’s “Best Efforts,” we believe SSA should 
not depend on the same level of NCC maintenance from the contractor past 201 5. 


2 



13 


• Lockheed Martin said SSA had the ability to add electrical distribution panels at the NCC. 
SSA in January 201 1 spent $2 million to install two new electrical risers for the NCC to 
provide capacity for additional cooling equipment on the data center floor, if needed. 

• The feasibility study in 2008 recommended roof repair for the NCC and the Utility Building. 
SSA spent SI .2 million and replaced the Utility Building roof in 2007 and the NCC 
warehouse roof in 2009. The Agency said it has also increased routine maintenance 
inspections on both building roofs. 

• SSA said it is also monitoring NCC plumbing conditions, performing foundation inspections, 
and monitoring HVAC ductwork, on recommendations from Ixjckheed Martin. 

Lockheed Martin said it found NCC maintenance practices were managed and executed 
properly, but for the facility to be sustained through 2014, the same level of facility management 
and oversight needed to be continued. SSA said its staff performs regular tours of the NCC and 
facility equipment, with an "annual building walk-around” with technical experts to determine 
repairs or future replacement projects on the building, grounds, and equipment. The cost for 
preventative maintenance at the NCC is projected to be $17 million in Fiscal Year (FY) 2011, 
and anticipated costs in FY 2014 are $18 million with a 10 percent annual increase through FY 
2020, according to SSA. 

Wc acknowledge that SSA has taken necessary steps to address structural and technical issues at 
the NCC identified by Lockheed Martin. Nevertheless, the longer the construction and transition 
to the NSC is delayed, the risks to the systems at the aging NCC will increase, as many of the 
building’s systems reach and surpass their lifecycle age. Proper planning and efficient plan 
execution is critical for the Agency so that the NSC is delivered before significant problems arise 
at the NCC and affect SSA operations. 

Should NCC outages occur at any time during the NSC building process, SSA will rely on its 
Second Support Center (SSC) as its backup data center and recovery site. As GSA and SSA 
continue the process in building the NSC, we are well aware of the challenges and delays that 
SSA faced in creating the SSC. The SSC was initiated in response to Agency vulnerabilities first 
identified in a 2002 Lockheed Martin assessment of SSA’s disaster recovery plan. The 
assessment concluded that no backup facility existed that could meet the Agency’s data 
processing needs in the event of a disaster that rendered the NCC unavailable. It was not until 
three years later, in 2005, that SSA worked with GSA to acquire a second data center. 

SSA encountered a number of delays during the acquisition and construction of the SSC. We 
determined it took six years, starting in December 2002, for SSA to plan, construct, and occupy 
the co-processing center. The Agency spent the first 26 months analyzing disaster recovery 
solutions, then 14 months selecting a site, then 32 months obtaining permits and constructing the 
new data center. In May 2006, the SSC tease was awarded, with an anticipated completion date 
of August 2007. Delays in construction pushed the SSC occupancy date to January 2009. 

SSA has said the SSC will not be “fully functional” until 2012, due to the time needed for 
efficiency testing and additional equipment and data connections. When we say “fully 
functional,” we mean that SSA will be able to meet its disaster recovery objectives by restoring 
critical functions within 24 hours of a disaster with less than one hour of data loss. Previously, 
SSA’s backup and recovery strategy relied on a vendor hot site, an alternate facility equipped 


3 



14 


with the technological capacity and personnel required to recover critical business functions or 
information systems, but SSA’s contract for its commercial hot site expired in September 2010. 
Rather than renew the contract, the Agency decided to purchase IT equipment in FY 201 1 to 
enable the recovery of the disability systems at the SSC. 

Given the importance of the Agency’s current efforts to build the NSC, we believe SSA should 
learn from its experience with the SSC and take the necessary steps to ensure proper planning to 
mitigate project delays and cost increases. In our September 2009 report. Processing Capacity of 
the Social Security Administration 's (Second) Support Center , we made several 
recommendations regarding the NSC planning process. Specifically, we recommended that SSA: 

1 . Accelerate the use of the SSC as a fully functioning data center, with particular emphasis on 
using the SSC as the disaster recovery site for the NCC. 

2. Develop a comprehensive, long-range IT strategic plan that includes possible constraints and 
challenges on all aspects of IT projects. 

3. Formally document the Agency’s plan to accelerate the use of the SSC as part of SSA’s 
overall disaster recovery plan, and continually update the disaster recovery plan as the SSC 
and NCC replacement become fully functional. 

At the time of the OIG report, SSA agreed with all of our recommendations. Recent disaster 
recovery tests at the SSC show that SSA has improved the time it takes to recover operations 
from 10 days in 2009 to a little less than five days in 2010. Over the next 12 months, SSA has 
indicated plans to reduce the five days down to about one day. Once SSA has demonstrated a 
process for recovering NCC workloads at the SSC, the Agency said it would update its disaster 
recovery documentation accordingly. 

The NSC will be built on a 63.5-acre site located between a data center operated by another 
Federal agency and Interstate 270 in Urbana, about 40 miles from both Baltimore and 
Washington, D.C., allowing SSA to maximize data-sharing speed and to limit the commute for 
relocated NCC staff. Both Baltimore Gas & Electric Co. (BGE) and Allegheny Power have 
indicated they can provide electrical infrastructure to the site. An OIG contractor. Strategic e- 
Business Solutions (ScBS), visited the site with SSA and GSA officials in November 2010 and 
did not discover any major obstacles to data center construction. We deem the NSC site selection 
acceptable because the infrastructure is in place for a new data center, as it would be located next 
to an existing Federal data center and it would be easily accessible via highways. 

However, according to GSA, the timeline for completing the build-out of the NSC will go 
beyond the original anticipated completion date of October 2013. We understand that the new 
schedule sets a September 2014 date for building completion, and a January 2015 date for the 
commissioning of the building. SSA estimates that data migration could take an additional 1 8 
months. Because there are many risks involved if this project were to fall further behind 
schedule, it is critical that GSA and SSA identify and develop plans for foreseeable construction 
delays, including excavation challenges and weather-related delays; and negotiate contracts with 
suppliers and builders to ensure materials are delivered and the work is completed on time. 


As previously stated, SSA has already allocated significant funds for repairs and maintenance at 
the aging NCC, where the possibility of an outage increases as time passes. Also, a number of 
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delays occurred in selecting a site for the SSC and building the SSC, and data recovery testing at 
the facility is still ongoing; OSA and SSA have now taken longer than anticipated to select a site 
for the NSC. And while the SSC has the capability to function indefinitely as a backup facility in 
the case of an NCC outage, SSA should not rely on the SSC indefinitely if there are delays in the 
construction of the NSC, because the Agency does not have a backup facility should the SSC 
become unavailable. 

Should the NCC’s UPS sustain an outage before the NSC is operational, SSA has said power can 
be fed directly to the data center from either its generators or BGE to maintain facility 
operations, though the IT equipment would then be susceptible to a shutdown because of any 
electrical surges or spikes. SSA said it is exploring other backup options, including: 

• Limiting UPS usage by relocating office functions on non-data center floors, and/or limiting 
non-data center floors to using local power; 

• Systematically shutting down data center operations to install new UPS systems for the data 
center only; 

• Purchasing a new UPS, estimated at $17 million, to service the entire building; 

• Renting a mobile UPS; and 

• Contracting for space at a host data center or renewing its disaster recovery hot site contract. 

We have done, and continue to do, significant and wide-ranging oversight of SSA’s planning of 
the transition to the NSC. Our most recent review, SSA ’s New Data Center Site Alternatives , 
evaluated the appropriateness of the short list of potential sites selected by GSA and SSA for the 
new data center. 

We also have additional reviews planned. One review will determine whether SSA followed best 
practices in developing its overall program of requirements for the new data center. Another review will 
evaluate the building plans for SSA's new data center and determine whether the Agency followed 
building design best practices to provide a data center that meets SSA’s requirements. Going forward, 
we also plan to have our contractors evaluate how well GSA and SSA plan for contingencies and 
mitigate the risk of any further delays in the project. 

SSA s Response to Congressional Inquiry Concerning New Data Center Site Selection . released 
in August 2010, was an independent assessment of whether building the NSC on or off SSA’s 
Woodlawn campus was the most cost-effective and best solution for SSA’s requirements. OlG’s 
contractor, SeBS, concluded that a GSA contractor did not address all NSC construction costs or 
the costs of transition to the NSC, and it did not provide an analysis of alternatives available in 
the event of potential schedule delays of the NSC. SeBS recommended SSA and GSA move 
forward with an off-campus site selection and assess the impact of NSC construction delays. 

In April 2010, we released two reviews, SSA s Use of Site Selection Industry Best Practices for 
its New Data Center, and SSA s Data Center Alternatives. The best practices review evaluated 
the appropriateness of the potential sites selected for the new data center and determined whether 
best practices were followed in the development of the project plan. The SeBS evaluation found 
that in general, SSA developed a highly sophisticated set of selection criteria to evaluate 
geographic areas of consideration and prospective properties. 


5 



16 


The Social Security Subcommittee requested our review of SSA’s data center alternatives in 
December 2009. The SeBS evaluation indicated that in general, SSA had conducted a 
sophisticated evaluation of its data center requirements, timeframes, and options in planning to 
replace its NCC facility. However, at that time, SeBS said additional due diligence efforts might 
be warranted. In particular, there were questions about the costs and the risks that were assigned 
to the different options for building a new data center. 

In conclusion, the sustainability and expansion of SSA’s IT systems are critical to the Agency’s 
ability to meet its goals and fulfill its mission; that mission affects nearly all Americans every 
day. The NSC project status shows it is imperative that the Agency have a clear IT vision that 
anticipates current and future needs. SSA’s current IT plans are short-term and do not provide a 
detailed description of how the Agency intends to address its IT processing needs 1 0 to 20 years 
into the future. The construction of the NSC in a timely fashion is SSA’s most critical IT 
investment over the next five years, to mitigate risks associated with relying on an aging NCC. 
With long-term planning and proactive management, we should be able to avoid a repeat of the 
current situation with the NCC. 

My office is dedicated to working with SSA to ensure that the construction of and transition to 
the NSC follows best practices and is carried out based on sound planning and management. We 
look forward to continuing to assist in this vitally important undertaking. I thank you again for 
the invitation to speak with you today, and 1 would be happy to answer any questions. 
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Chairman JOHNSON. Thank you, sir. I appreciate it. 

You indicated that — I know I am not supposed to ask questions 
yet, but I am going to. 

[Laughter.] 
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Chairman JOHNSON. You indicated that their recovery time is 
five days. And when I was down there, Mr. Croft, you indicated to 
me you thought they could do it in two. 

Mr. CROFT. Sir, we are at four days now, and we are working 
towards one. 

Chairman JOHNSON. Okay. Thank you. 

Mr. O’CARROLL. And when we did our report on this, sir, we 
observed the testing, which is what we are reporting. That was 
when they were at four-plus days, which is why we rounded it to 
five, but from talking to the agency, they have brought that five 
down to four. But at the time, it was still almost five days. 

Chairman JOHNSON. Okay. Four legislative days is five. 

Mr. Foley, you are recognized for five minutes. 

STATEMENT OF DAVID FOLEY, DEPUTY COMMISSIONER OF 

THE PUBLIC BUILDINGS SERVICE, U.S. GENERAL SERVICES 

ADMINISTRATION 

Mr. FOLEY. Thank you. Good morning, Chairman Johnson, 
Chairman Denham, Ranking Members Becerra and Norton, and 
Members of the Subcommittees. I am pleased to have the oppor- 
tunity today to discuss the considerable progress GSA has made in 
delivery of the new SSA National Support Center. 

I am glad to report the project is on budget, and GSA and SSA 
have recently reached two significant project milestones in the site 
selection and procurement for the data center. After an extensive 
due diligence process, we recently announced the site selection of 
the new Support Center at Urbana in Frederick County, Maryland. 
Last month GSA also issued the first phase of our design/build con- 
struction solicitation. 

GSA and SSA are working closely together to ensure we achieved 
our new project milestones while remaining on budget and mini- 
mizing risks to deliver an efficient, modern, and secure data center 
to support SSA in meeting their mission goals and providing the 
best value to the taxpayers. 

GSA diligently sought locations that would meet SSA’s unique 
requirements for a data center. We conducted an extensive evalua- 
tion of potential sites within a 40-mile radius of Woodlawn, Mary- 
land. We reviewed government-owned properties, contacted local 
communities, and requested expressions of interest through Fed- 
eral Business Opportunities online. 

These efforts resulted in over 150 potential sites that were evalu- 
ated against specific criteria, including: site characteristics, location 
and accessibility, energy and utilities, security and operations, en- 
vironmental impacts, local planning and development, land and 
site development costs, and schedule risks. 

In 2009, at these committees’ request, GSA conducted a study to 
examine the possibility of locating the new data center at the cur- 
rent campus. In April of the following year, we delivered this study 
which showed that building on the SSA campus would present sig- 
nificant concerns and high risk, including the possible disruption of 
mission-critical operations. 

Although GSA and SSA remain committed to the presence of 
SSA at the Woodlawn campus for current mission needs and future 
expansions, the study showed that the data center would be better 
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served at a new site where risk and cost would be minimized, and 
the data center could be completed more quickly. 

Upon the completion of this study and with the support of these 
committees, GSA continued to press forward with our review of po- 
tential sites. Our deliberative process led to a short list of two sites: 
Johnnycake Road in Baltimore County and Urbana in Frederick 
County. 

Given the importance of this project and the potential impacts of 
a site selection decision, GSA initiated an environmental assess- 
ment last August that we completed in January where the GSA so- 
licited public comment and assessed all environmental impacts and 
advantages and disadvantages for each site. 

After a full and fair analysis and in coordination with SSA, GSA 
selected Urbana as the site for the new data center. This site will 
most effectively meet SSA’s needs and best serve the interests of 
the taxpayers. 

Urbana not only meets SSA’s requirements but offers a variety 
of benefits, including its physical site characteristics, available in- 
frastructure, and favorable environmental conditions. Additionally, 
Urbana is most favorable in minimizing risks, cost, and schedule 
impacts. 

Now that we have announced the site, we are initiating the ac- 
quisition of the property, which we anticipate to be completed this 
June. We are also moving forward with the next phase of this 
project with the procurement for the design and construction of the 
facility. 

GSA and SSA worked collaboratively, consulting with leading 
data center experts to develop a program of requirements for a de- 
sign/build solicitation. This POR was completed last August. The 
project will meet all of SSA’s requirements and all of the appro- 
priate security and IT redundancy standards for a data center of 
this type, as well as achieve a minimum of LEED Gold certification 
and the goals of the executive orders for sustainability and energy. 

The National Support Center project is based on an integrated 
design/build delivery method that includes a design firm and a con- 
structor contractor. GSA is using a two-phase procurement process 
that evaluates the contractor’s qualifications first to establish a 
short list of most highly qualified bidders, and then considers tech- 
nical proposals and price in the second phase to achieve the overall 
best value for the government. This process began last month when 
GSA issued a request for qualifications, inviting contractors into 
the bidding process. 

We look forward to the next major milestones on this project. 
Phase 2 of the design/build solicitation is scheduled for April, site 
acquisition is scheduled for June, and award of the design/build 
contract is on track for next January, with substantial completion 
in September of 2014. 

GSA appreciates the opportunity to come here today to highlight 
the considerable progress we have achieved on this project. We look 
forward to continuing to work with you on the successful delivery 
of this data center. 

Chairman Johnson, Chairman Denham, Ranking Members 
Becerra and Norton, and Members of the Subcommittees, this con- 
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eludes my statement, and I will be pleased to answer any questions 
you may have. 

[The prepared statement of Mr. Foley follows:] 
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Good morning Chairman Johnson, Chairman Denham, Ranking Members Becerra and 
Norton, and Members of the subcommittees. My name is David Foley and I am the 
Deputy Commissioner of the General Services Administration's (GSA) Public Buildings 
Service. I am pleased to have the opportunity today to discuss the considerable 
progress GSA has made, on behalf of the Social Security Administration (SSA), in the 
delivery of a new Social Security Administration National Support Center. 

We have reached significant project milestones in the two critical paths of site selection 
and requirements development for a design/build construction solicitation. After an 
extensive due diligence process, we announced at the beginning of this month the site 
selection of the new support center site at Urbana in Frederick County, Maryland. Last 
month, GSA also issued the first phase of our design/build construction solicitation. 
GSA and SSA are working closely together to ensure we achieve our new project 
milestones, while remaining on budget and minimizing risks in order to deliver an 
efficient, modern, and secure data center to support SSA in meeting their mission goals 
and providing the best value to taxpayers. 

Site Selection 

GSA diligently sought a location that meets SSA's unique requirements for a National 
Support Center. We conducted an extensive evaluation of potential sites located within 
a 40 mile radius of Woodlawn. We reviewed Government-owned properties, contacted 
local economic development and planning groups, and requested expressions of 
interest from land owners and authorized agents through a Federal Business 
Opportunities 1 online notice. These efforts resulted in over 150 potential sites that were 
evaluated against project specific criteria. These factors included: 

• Site characteristics; 

• Location and accessibility; 

• Energy and utilities; 

• Security and operations; 

• Environmental impacts; 

• Local planning and development; 

• Land and site development costs; and 

• Schedule risks. 

We followed a deliberative process of reviewing sites against the initial criteria, paring 
down the list, and then conducting further due diligence to select a final site. 

In 2009, at the committees’ request, GSA also conducted a study to examine the 
possibility of locating the new data center on the current campus. In April 2010, we 
delivered this study, which showed that building on the SSA campus would present 
significant concerns and unacceptably high construction risk, including the possible 
disruption of the mission-critical operations at the existing National Computer Center. 


www.fbo.gov 
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Though GSA and SSA remain committed to the presence of SSA at the Woodlawn 
campus for current mission needs and future expansions, the study showed that the 
National Support Center would be better served at a new site, where risk and cost 
would be minimized and construction could be completed more quickly. 

Upon the completion of this study and with the support of these committees, GSA 
continued to press forward with our review of new sites. This iterative process led to a 
short list of two sites, Johnnycake Road in Baltimore County and Urbana in Frederick 
County. Given the importance of this project and the potential impacts of a site 
selection decision, GSA initiated an Environmental Assessment in August 2010. During 
this recently completed process, GSA solicited public comment and assessed all 
environmental impacts, evaluating the benefits and potential drawbacks for each site. 

After this thorough analysis, we announced the selection of Urbana as the site that will 
most effectively meet SSA’s needs and best serve the interests of taxpayers. This site 
fully meets the technical requirements for this unique mission-critical data center facility; 
offers a variety of benefits including its physical site characteristics, available utility 
infrastructure, and favorable environmental conditions; and the site is the most 
favorable in terms of minimizing risks, costs, and schedule impacts. Now that we have 
announced the site, we are moving toward acquisition, which we anticipate in June 
2011 . 

Requirements Development 

Successfully moving forward with the next phase of this project, which is the 
construction portion, required that we develop the right Program of Requirements (POR) 
for a design/build solicitation to meet this mission. GSA and SSA worked 
collaboratively, consulting with leading experts in data center construction to develop 
this POR, completed on schedule in August 2010. 

GSA has worked with SSA to ensure this facility serves the SSA's information 
technology needs, and the needs of taxpayers, for the long term. With the help of 
consultants, we developed a growth model for equipment requirements, which takes 
into account both SSA historical data, as well as industry trends for newer equipment 
technology. The project will be designed to meet the initial 10-year requirements, with 
expansion capabilities based on 20-year projections. 

The project will also meet Interagency Security Committee Level IV standards and Tier 
III Certification by the Uptime Institute. A Tier III Certification ensures continued 
operations and redundancy of system facilities. Furthermore, GSA is committed to 
achieving a minimum of a Gold certification under the Leadership in Energy & 
Environmental Design program of the U S. Green Building Council, as well as achieving 
the goals outlined in the current Executive Orders for sustainability and energy. 
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Design/Build 

The National Support Center project is based on an integrated delivery by a 
design/build team, including a design firm and a construction contractor. This is a two 
phase process which first evaluates the contractors' qualifications to establish a short 
list and then considers technical proposals and price in the second phase. GSA has 
begun the first phase of selecting a design/build contractor to construct this critical 
facility. A Request for Qualifications, inviting contractors into the bidding process, was 
posted on the Federal Business Opportunities website on January 26, 2011. 

We anticipate award of the contract for design and construction by January 2012. 
Substantial construction completion is scheduled for September 2014, at which time the 
building will be turned over to begin commissioning and IT migration. 

Budget and Schedule 

The project remains on budget, though the due diligence conducted in our review of 
sites has pushed back the construction completion from October 2013 to September 
2014. 

We look forward to the next major milestones on this project, including Phase 2 of the 
design/build solicitation (April 201 1 ), site acquisition (June 2011), award of the 
design/build contract (January 2012), and finally substantial completion of the project 
(September 2014), at which time commissioning and IT migration will begin. 
Commissioning will be completed in January 2015 and, we understand from SSA, IT 
migration will be completed by August 2016. 

Risk Management 

While we move forward on this critical project, we are taking a number of steps to 
minimize risks and ensure the budget and schedule stay on track. 

GSA has developed bidding strategies that maximize competition and alternative design 
solutions. We are performing market research prior to award and developing 
independent government cost estimates. These techniques will increase the probability 
of receiving bids within budget. As with the site selection, we have adopted detailed 
criteria for the design/build contract and will consistently apply them to the evaluation of 
offers. This process will limit procurement schedule risks. We also will employ 
consultants and contractors with data center experience for quality assurance reviews 
during the design, construction management and inspection stages. Finally, GSA will 
continue to work closely with SSA to monitor and evaluate and minimize scope changes 
and ensure that they will be managed within the project budget and schedule. 
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Conclusion 

GSA appreciates the opportunity to come here today to highlight the considerable 
progress we have achieved on this project. We look forward to continuing to work with 
you on the successful delivery of this data center. 

Chairman Johnson, Chairman Denham, Ranking Members Becerra and Norton, and 
Members of the subcommittees, this concludes my statement. I will be pleased to 
answer any questions you may have. 


Chairman JOHNSON. Thank you, sir. We appreciate your com- 
ments. 

Mr. Croft, thank you for being here, and you are recognized. And 
I appreciate your help down south. 

Mr. CROFT. Thank you. 

Chairman JOHNSON. Pleasure. 

STATEMENT OF KELLY CROFT, DEPUTY COMMISSIONER FOR 
SYSTEMS, SOCIAL SECURITY ADMINISTRATION 

Mr. CROFT. Chairman, Ranking Members, and Members of the 
Subcommittees, thank you for the opportunity to share information 
about our data center replacement project. My name is Kelly Croft, 
and I am the Deputy Commissioner for Systems at Social Security 
Administration (SSA). I have worked at the agency for 28 years 
and have been in my current job since January of 2010. I am re- 
sponsible for safeguarding the information assets of Social Security, 
and also delivering information technology (IT) services across the 
agency. 

At Social Security, our reliance on technology has dramatically 
evolved since I joined the agency as a front-line public service 
worker in the 1980s. In those days, I took retirement and disability 
claims on paper forms and assembled cases in thick paper folders. 

Today, the vast majority of our work is electronic, and we are ex- 
traordinarily more efficient because of it. Our claims process is vir- 
tually paperless. We have a number of highly regarded Internet ap- 
plications for public use, and it is not unusual for us to process 
over 150 million computer transactions in a single day. 

To be blunt, if our computer systems are down, then we are pret- 
ty much out of business. We can still talk to people in person and 
on the telephone, and we do have contingency arrangements to en- 
sure established payments go out. But we cannot do things like 
compute and pay new claims, change direct deposit accounts, issue 
Social Security cards, or even answer specific questions about bene- 
ficiary records. Pretty much all we do relies on high availability 
computer systems. 

Even an hour of computer outage for us is a very big deal, and 
at the massive scale we operate on, with over 50 million seniors 
and disabled people to serve, an extended outage of multiple days 
would have national implications. 
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The hubs for our entire IT infrastructure are our two data cen- 
ters, one in Maryland and one in North Carolina. Data centers are 
special buildings that require significantly more security and me- 
chanical features than normal office space. For example, data cen- 
ters should have sophisticated electrical systems and generators. 
They should also have advanced fire suppression systems. In addi- 
tion, the equipment in data centers produce large quantities of 
heat, so they need extremely robust air conditioning. 

Our North Carolina center opened in 2009, and it is a modern, 
well-designed facility. On the other hand, our Maryland center is 
30 years old, and the building is fraying. I want to emphasize that 
the computers inside our Maryland center are modern; but if the 
building fails because of a plumbing, heating, ventilating, and air 
conditioning, or electrical breakdown, it won’t matter how capable 
the computers are. They simply won’t work. 

Both of our centers function 24/7 and process a portion of our 
daily computing workload. Both also have the reserve capacity to 
run the critical systems of the agency in the event of a long-term 
outage at the sister facility. If we lost our Maryland data center, 
it would currently take us four days to recover critical operations 
in North Carolina. We are working to lower our recovery time to 
just one day. 

As bad as any days of national outage would be, we would also 
be left with just one remaining data center and no viable backup 
for that. In light of the wake-up call that came with 9/11 and for 
something as important to the country as the delivery of Social Se- 
curity services, it is crucial that we always have a viable backup 
position. 

We were relieved when Congress appropriated $500 million in 
2009 to replace our aging Maryland facility with a state-of-the-art 
data center, a facility that we expect will faithfully serve the Amer- 
ican public for decades, just like our old building has. 

We are relying on the expertise of our General Services Adminis- 
tration (GSA) colleagues to manage the process for acquiring land 
and building our replacement data center. We provided our re- 
quirements to GSA, and I assure you we seek only a safe, energy- 
efficient, and modern data center that will be sized to handle cur- 
rent and projected computing workloads for the agency. 

As a final note, we all worry about the length of time a large gov- 
ernment building project like this takes. The current schedule will 
not provide me keys to the new center until January of 2015, and 
then it will take my staff up to 18 months to safely move all of our 
extensive operation out of the old building and into the new. 

In Social Security, we will do everything we can to ensure our 
old building continues to function while we wait. Although we can- 
not do large-scale building improvements without unacceptable im- 
pact to our operations, we will continue to undertake smart, cost- 
effective maintenance work. 

We strongly appreciate the support we have received from the 
Congress. I look forward to your questions, and will do my best to 
answer them. Thank you. 

[The prepared statement of Mr. Croft follows:] 
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Introduction 


Chairmen, Ranking Members, and Members of the Subcommittees: 

Thank you for this opportunity to share information about our data center 
replacement project. 

Many good things are happening at Social Security. Despite large workloads 
caused by the economic downturn, we have cut the wait for a disability hearing 
from a high of nearly 18 months in August 2008 to just over a year as of January 
2011. We have significantly reduced busy signals and wait times for telephone 
service, and wait times in field offices are down slightly. Productivity, program 
integrity work, and employee satisfaction are all up. Our 20 highly regarded 
Internet applications give the public convenient access to our services while 
alleviating traffic in our offices. 


None of these improvements would have been possible without smarter use of 
information technology (IT), and that technology relies on a smoothly functioning 
core computer system that is one of the largest in Government. It certifies the 
payment of more than $60 billion each month to over 50 million seniors and 
disabled people, money that is pumped into the national economy. Jobs and lives 
depend on Social Security doing its job without interruption. 

For over 30 years, the National Computer Center (NCC) has housed our core 
computer systems. Many of the NCC’s facility infrastructure systems are well 
past their designed life cycle. Without a long-term replacement, the NCC will 
deteriorate to the point that a major failure to the building systems could 
jeopardize our ability to handle our increasing workloads without interruption. 
Recognizing the urgency of the situation, Congress provided us with $500 million 
in 2009 toward constructing and partially equipping a new data center. 

We refer to the new data center as the National Support Center (NSC). Once 
complete, the NSC will meet our anticipated IT workloads for the next 20-plus 
years. Throughout the project to construct the NSC, we have worked attentively 
to ensure that the building will meet our requirements. We developed our 
requirements based on our expertise in data center design and operations and in 
consultation with outside experts such as the Uptime Institute and the Lawrence 
Berkeley National Laboratory. We also used best practices and lessons learned 
from our recently completed Second Support Center (SSC) in North Carolina. 
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Congress has provided the General Services Administration (GSA) the authority to 
lease, purchase, or build facilities for most Federal agencies, including our agency. 
GSA has broad-ranging experience exercising this authority, and we support its 
efforts on our behalf. Guided by the functional requirements, GSA recently 
selected a site for the NSC. As required by law, we notified the Committees on 
Appropriations of the House of Representatives and the Senate that GSA had 
selected a site for our new data center and would proceed with its process to 
purchase it following a 10-day notification period. GSA will also manage the 
design and construction of the building at the selected site. 

Currently, GSA estimates that the NSC project is about a year behind its original 
schedule. The estimated date for construction completion is September 2014 and 
for final commissioning of the building is now January 2015. Complete IT 
migration could take as long as 18 months after commissioning. GSA has 
expressed that there may be future opportunities to make up lost time without 
cutting comers. We support GSA’s efforts to identify and capitalize on those 
opportunities. 

As responsible managers, we have taken assertive action to ensure the continuity 
of our operations through extensive risk mitigation and disaster planning. These 
improvements should help keep the NCC viable through the point of transition to 
the NSC. The SSC, which assumed production workloads in May 2009, already 
serves as a co-processing center for a significant portion of the NCC’s workloads. 
In the event of an NCC failure, we can currently recover all critical workloads at 
the SSC within four days. Next year, we anticipate being able to reduce that 
recovery time to one day. 

While our risk mitigation and disaster planning activities provide a bridge between 
now and the NSC’s completion, by no means do they eliminate the dire need for a 
new data center. Despite all of our best efforts to preserve the NCC for as long as 
necessary, there is always the potential that a critical facility infrastructure system 
could suddenly fail. While the SSC could serve as our sole data center in an 
emergency, there would then be no backup for the SSC. This scenario would 
place the Nation in an extremely vulnerable position. Social Security is too 
important to the national economy and to the lives of a huge number of Americans 
to rely on a single data center. 

Background on the NCC 


We designed and built the NCC in the 1970s. Industry standards and best 
practices for data centers, along with technology, have changed radically since 
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then. Modem data centers now have redundant electrical and cooling systems to 
provide continuous IT operations during essential preventative maintenance 
activities on facility systems or in the event one system fails or needs replacement. 
The lack of redundancy in the NCC’s cooling and electrical systems complicates 
our efforts to maintain and preserve the building. 

Until recently, simply getting additional power to our IT equipment in the NCC 
was one of our biggest problems. Out of necessity, we mitigated this problem by 
adding more electrical risers or pathways to deliver power to the data center. This 
improvement came at significant expense and required three data center 
shutdowns between 2009 and 2010. 

Each time we need to add IT equipment, we increase the likelihood of needing 
more cooling. The computer room air conditioning and overall heating, 
ventilating, and air-conditioning (HVAC) systems on the data center floor may 
prove insufficient to accommodate those cooling needs in the future. Moreover, 
the NCC’s HVAC system is already well beyond its expected life cycle and is 
impossible to replace while keeping the data center running. 

A related NCC design problem is that employee office spaces in other areas of the 
building share the same power lines and HVAC system as the data center. This 
design problem means that a potentially isolated issue in an area outside the data 
center, such as a minor receptacle overload at someone’s workstation, could 
temporarily shut down some power to the data center and HVAC system. 

However, the biggest power concern at the NCC is the building’s Uninterruptable 
Power System (UPS). The UPS is not an off-the-shelf product; it was designed 
specifically for the building. It is critical to maintain clean, uninterrupted power to 
the data center at all times. While we have extended our service contract with the 
UPS maintenance vendor over the years, the vendor recently advised us that it 
could not guarantee repairs in the near future. The necessary parts are simply no 
longer available. If the UPS failed, we would have to bypass the system and 
deliver unconditioned power to the data center equipment, which could quite 
potentially damage the equipment. Replacing the UPS would require significant 
downtime at the NCC. 


We face even more fundamental problems at the NCC, such as tangled and 
overcrowded telecommunications and electrical cables underneath the data center 
floor. 
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Figure 1 : Under-Floor Cabling Conditions in the NCC Data Center 



Tangled cables can block the under-floor airflow that cools our servers, and we 
cannot work on the cables safely without shutting down the affected systems. 
Similarly, troubleshooting problems is difficult when we cannot isolate cable pairs 
easily to determine whether problems exist in the cables or in the IT equipment. 
There is also an elevated risk of data corruption, because electro-magnetic 
interference from the electrical wires that are located too close to the 
telecommunication wires can distort data transmission. 

Another basic threat to the data center is the NCC’s pipes for both the water 
supply and fire suppression systems. The pipes are original to the building. Many 
of the pipes are clogged and corroded. Failure of the pipes could result in 
extensive water damage. 
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Figure 2: Clogged and Corroded Piping in the NCC 



A recent incident illustrates how a problem as basic as failing pipes can affect the 
data center’s operations. Last year, our facilities staff noticed water on the floor of 
one of the large battery rooms in the NCC. They quickly traced the source to a 
leaking water pipe in the room. Any water in close proximity to high-voltage 
batteries presents a serious hazard to the building and its personnel. 


In order to fix the leak, plumbers needed to expose the pipe and cut off the water 
supply. Unfortunately, without redundant systems, cutting off the water supply to 
the pipe also required cutting off the water supply to the large air handling 
equipment that is responsible for cooling our computing space. Since the air 
handling equipment had to be turned off, we had to actually shut down a portion of 
our national computing operations while making the repairs. 

Thankfully, we did not experience serious service disruptions because we 
managed to complete the repair in the early morning hours of a weekend. 
Nonetheless, just to fix a seemingly simple leak ultimately required extensive 
planning, work staging, and a major IT shutdown. If the leak had been caused by 
a pipe that burst in the middle of a business day, we would have experienced 
major IT service disruptions. 


As the NCC has aged, we have continuously upgraded and repaired facility 
infrastructure systems to the best of our ability. Similar to how we maintain our 
homes, incremental improvements are an industry best practice for maintaining 
facility systems beyond their life cycle. Wc must incrementally repair these 
infrastructure systems, where possible, because we cannot totally replace them in 
the existing NCC. To replace them, we would have to shut down the building 
completely for an extended period of time. 
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Figure 3: Sample of Major Agency Workloads Affected bv an NCC Shutdown 


Workloads 

FY 2010 

Average/Work Day 

Retirement and Survivors Claims Completed 

4.700.990 

18.804 

Initial Disability Claims Completed 

3.161.314 

12.645 

Hearings Completed 

737.616 

2,950 

Continuing Disability Reviews Completed 

956.182 

3.825 

SSI Non-Disability Redeterminations 

Completed 

2.465.878 

9.864 

SOO Number Transactions Handled 

67.544.780 

270.179 

New and Replacement Social Security Cards 
Issued 

17.250.208 

69.001 

Field Office Visitors 

45.000.000 

180.000 


Following consultation with Congress, we concluded that building a new, state-of- 
the-art data center was the best way forward. In support of our efforts, in 2009, 
Congress provided us the funds to construct and partially equip the NSC. We 
have provided GSA with our requirements for the NSC’s design and operations. 


NSC Project Update 

There are several important milestones along the way to full completion of the 
NSC. GSA, working closely with a team from our agency and outside experts, has 
completed three of those milestones within the past six months. We are 
encouraged by the recent project developments, and continue to work with GSA to 
complete this key investment in a timely manner. 

In August 2010, GSA achieved its first important milestone with completion of the 
Program of Requirements (POR). The objective of the POR is to provide the 
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necessary business requirements, including space, power, cooling, and design 
guidance for a Design/Build (D/B) contractor to successfully engineer, design, 
construct, and deliver the NSC. We worked closely together with GSA to develop 
the POR in collaboration with the GSA contractor, Jacobs. We ensured that the 
POR met our technical requirements for data center design and operations. 

GSA completed a second important project milestone in January 201 1 when it 
posted online the first of two Requests for Proposal (RFP) from D/B contractors. 
The first RFP requested that interested D/B contractors provide information 
concerning their prior experience on relevant projects, past performance on 
relevant projects, and project team qualifications and approach. The second RFP, 
which GSA plans to issue in April 2011, will request that qualified D/B 
contractors provide design developments, project management and delivery plans, 
oral presentations, project labor agreements, and pricing. 


The third major project milestone completed within the past six months is site 
selection. GSA recently informed us that it selected a site for the NSC. We accept 
GSA’s site selection decision because the selected site meets our functional 
requirements. Those published requirements include that the site: 

• Is contiguous and within 40 miles of our headquarters in Woodlawn, 
Maryland; 

• Provides geometry and topography suitable for development; 

• Has no known landfills or hazardous waste, soil, or water contamination, 
on or near the site, for which cleanup would significantly impact project 
cost or schedule; 

• Has developable area that is not located within the 100- or 500-year flood 
plain or does not have other geological or environmental impairments; 

• Has reasonable access to electrical power, water, telephone, satellite and 
fiber optics; and 

• Shall not significantly affect the project schedule if assemblage of multiple 
sites is required. 


We look forward to the timely completion of the remaining milestones on GSA’s 
revised project timeline. Following the issuance of the second RFP in April, GSA 
anticipates purchasing the selected site in June 2011. It also plans to award the 


7 



33 


D/B contract in January 2012 and finish constructing the NSC in September 2014. 
GSA estimates final building commissioning by January 2015, at which point it 
may take up to 18 months for us to migrate all of our IT from the NCC to the 
NSC. 

Risk Mitigation and Disaster Preparedness Plans 

Social Security has a history of providing excellent service to the public. Over our 
75-year history, we have demonstrated that we meet challenges, including 
emergencies such as Hurricane Katrina when, within days of the storm, we 
established makeshift offices at evacuation centers and shelters along the Gulf 
Coast to issue payments to our beneficiaries. 


Our engineers and technical staff maintaining the NCC are no exception to this 
proud tradition of service. They work every day to manage and maintain the 
building. They diligently continue to explore ideas and opportunities to overcome 
or work around the limitations of the NCC’s infrastructure systems. 

In 2007, we commissioned an independent study to examine the condition of the 
NCC and identify options to accommodate and support our data processing 
operations into the future. The study found that we had managed and executed our 
NCC maintenance practices in an excellent manner and that we would need to 
continue these efforts to sustain the facility. The study recommended that we 
build or lease a new data center on an accelerated schedule. 

To help us sustain the NCC until the new data center would be operational, the 
study identified specific areas of risk for us to address. Where economically and 
operationally feasible, we have implemented most of the study’s 
recommendations. 


For example, we replaced deteriorating electrical feeder cables, which deliver 
power into the NCC from outside, and repaired or replaced roofs and lightning 
protection grids. As mentioned earlier, we increased electrical distribution 
capacity to the data center by adding electrical risers. We also procured available 
spare parts needed to maintain and repair our UPS and worked with our UPS 
maintenance vendor to extend our service contract. When the current UPS 
contract expires in 2012, we will negotiate a new agreement with our vendor 
through 2015; however, the vendor recently informed us that it would be able to 
provide only a “best effort” extension from 2015 to 2018. Accordingly, we have 
already begun discussing options for obtaining and installing UPS support to the 
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data center in the event of a catastrophic failure. Those options may include 
extreme measures like machining spare parts not otherwise commercially 
available, bringing in a portable UPS to provide power, or replacing the entire 
UPS. 

Of course, we know there are limitations to a comprehensive and aggressive 
program of preventative maintenance and disaster preparedness at the NCC. 

Many of the building’s primary infrastructure systems such as the HVAC and 
plumbing need replacement but are impractical to replace while the NCC is active. 

Realizing that we will have to rely on the NCC for at least the next 5 years, we 
will do what we can to extend the life of the building. Therefore, we are working 
with GSA to complete a Building Engineering Report and a feasibility study to 
provide an updated assessment of the NCC facility systems and structure. 
Specifically, we will work with GSA in: 

• Evaluating the current condition of all major systems within the NCC; 

• Reevaluating all of the prior study recommendations for the NCC; 

• Determining how to maintain the NCC as a viable and functional data 
center for critical IT equipment through 2020, including a project 
schedule and cost information on any recommendations; and 

• Formulating methods to perform necessary renovations or repairs with 
little or no downtime at the NCC until we migrate the data center’s 
critical IT equipment to the NSC. 

We remain hopeful that our on-going best efforts to extend the life of the NCC 
provide us a bridge between now and the NSC’s completion. Still, we know that 
the longer we must rely on the more than 30-year-old structure, the higher the risk 
is that a significant building failure may require us to move all of our IT 
operations to the SSC. 

The SSC building opened two years ago and it has grown to become a fully 
functioning data center that shares a portion of our daily IT processing load with 
our aging NCC. The two facilities work in tandem. Both serve as primary 
computing locations for important IT functions and both have the reserve 
computing capacity to recover all the critical functions from the other site in the 
event of a disaster. 
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Before the SSC came online, our disaster recovery strategy relied on the use of a 
commercial data center. There were many weaknesses with the old strategy. It 
assumed we would always be able to occupy the commercial site even though we 
shared it with other organizations on a first-come, first- serve basis. The 
commercial site was not large enough to handle our operation at reasonable 
performance levels, and it lacked specific technology that we required. Even if 
everything went well at the commercial site, our recovery time was at least a 
week. 


However, even one day of potential IT service outage would cause a major 
disruption to our customers and cost approximately $25 million in lost agency 
productivity. In addition, if we lost use of the NCC before completing the NSC, 
we would be forced to revert to an unsatisfactory reliance on a commercial facility 
as a backup. 


Completion of the NSC will allow us to move all IT activities out of the existing 
NCC and will add significant stability to our IT enterprise since both the NSC and 
SSC would be modem, efficient, and well-designed facilities. We will still face IT 
disaster risks, but not as much from a major facility failure, which is much more 
likely to occur in an older building like the NCC. 


Conclusion 


The investment Congress has made in the construction of the NSC is a good 
decision for the country. The American people and the overall economy depend 
on the benefits we provide. Securing the continuity of our agency’s operations 
and the very fabric of this country’s safety net require that we replace the NCC as 
quickly as possible. 

We continue our work to provide the necessary support and input to GSA so that it 
can effectively manage the NSC site procurement, design, and construction 
processes. In keeping with our stewardship responsibilities, we have taken 
assertive action in the area of risk mitigation and disaster preparedness. We will 
continue to pursue creative preservation of the NCC. We will also use the SSC’s 
capabilities to assist the NCC and take over in the event of a failure at the NCC. 
However, these are only temporary solutions. Any outcome other than the 
completion of the NSC will result in increasing risk of significant disruption in the 
delivery of Social Security services. 
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Chairman JOHNSON. Thank you, sir. I appreciate your testi- 
mony. I want to thank you all for your testimony. We appreciate 
you being here today. 

To make sure everyone has a chance to ask questions, I am going 
to limit my time for questions to five minutes, and ask Chairman 
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Denham and the ranking members to limit their time to five min- 
utes. 

Mr. Foley, Social Security is supposed to get the keys to the new 
center in January 2015, and that is a year later than originally 
planned. And the way you talk, it sounds like to me you are about 
to delay it another year. Can you talk to that question? 

Mr. FOLEY. We are on schedule to turn the keys over to them. 
As I mentioned, construction would be complete in September of 
2014. There is some commissioning of the major building systems, 
as Mr. Croft, my colleague, testified. 

The data center is a complicated operation and complicated 
building system, so we have to do all the testing to make sure that 
it will work and support their operations. But we don’t anticipate 
any further delays as we move forward on the project. 

Chairman JOHNSON. Well, why can’t you move it faster? I 
mean, you know where the site is. Why are you waiting until June 
to purchase it? 

Mr. FOLEY. We are actually in the acquisition for the site phase. 
We are moving forward on the procurement for the construction. So 
we are moving forward on all of those. It will take us, we think, 
that long to actually complete the acquisition. 

I should say, though, that GSA is committed to looking for every 
opportunity to accelerate the project wherever possible. We are 
looking at multiple avenues to do that, whether it is exploring in- 
centive clauses, potentially, in the construction contract. 

Once we have a contractor on board, we can clearly work with 
them to look at phasing and sequencing, delivery of long lead items 
to see where we can actually cut time out of the construction sched- 
ule, although I should note that as you look at reducing time 
frames, that also increases, potentially, project risk. So we have got 
to make sure we do our due diligence and look for those tradeoffs. 

But we do recognize the urgency of this facility, and are com- 
mitted to looking for every way we can to accelerate. 

Chairman JOHNSON. Okay. Well, I just wonder why you are 
waiting until July to confirm the site and, you know, get it bought. 
Why is it taking you that long? 

Mr. FOLEY. Well, we are actually in the acquisition phase right 
now, so we are working to acquire 

Chairman JOHNSON. You just think it would take that long to 
get it done? 

Mr. FOLEY. Well, there are a couple of things that have to hap- 
pen with the site. We actually have to do some of the subdivision 
of the site. They have to bring some of the infrastructure in before 
we can actually acquire the site and actually transfer the deed to 
the Federal Government. We will have a purchase agreement in 
place prior to that. 

Chairman JOHNSON. You got a fixed price? 

Mr. FOLEY. We are in negotiations now. 

Chairman JOHNSON. Okay. Mr. O’Carroll and Mr. Croft, do you 
see how we can make up for lost time any other way? 

Mr. O’CARROLL. Well, Chairman, as you are well aware, we are 
very concerned with the parallel issues that are coming up with the 
aging NCC, and we are encouraging both SSA and GSA to look for 
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any opportunity they can to trim down on the time it takes to do 
this. 

But at the same time, we don’t want any corner-cutting or any 
degradation in terms of the services or the quality of the work. So 
I can assure you we have a contractor who is going to be taking 
a look and making sure that they are staying on schedule, and any 
opportunity to cut that time will be encouraged. 

Chairman JOHNSON. So we have a contractor already? 

Mr. O’CARROLL. We have a contractor. It is called Strategic e- 
Business Solutions, that works for us. One of our concerns was at 
the beginning, when we began our oversight, we didn’t — we have 
IT expertise on our audit staff, but we don’t have experience with 
state-of-the-art IT, or data facility construction. 

So we went to Strategic e-Business, and they have a subcon- 
tractor called Fortress International that they are using, both of 
which have done a lot of work with computer centers and redun- 
dant computer centers. We are going to have them taking a look. 

We don’t know whether we are going to put it out to them or to 
another contractor. But we will have a three-stage process taking 
a look at the next several years out. 

Chairman JOHNSON. Do we know when construction will begin? 

Mr. FOLEY. We are looking at award of the design/build contract 
next January. Depending on the design period, one of the advan- 
tages of design/build is it actually allows us to streamline the proc- 
ess, and they can begin some of the site work and construction 
prior to the final design. 

But until we actually have some of the preliminary design and 
know what it looks like, we don’t have an exact date on when we 
will begin moving dirt on the site. 

Chairman JOHNSON. Is there any reason why we can’t dupli- 
cate the site down in Carolina? 

Mr. FOLEY. I am not familiar with all of the specific characteris- 
tics, but I think Mr. Croft can talk to some of the differences. 

Mr. CROFT. Yes. First, sir, to your overall question about speed- 
ing it up and making sure it goes well, I will say we are committed 
to keeping up with David and his team. I think it is a really good 
team. They have some very good people on it, as do we. And we 
are going to keep a lot of oversight on this. 

But I would also say we want to be careful we don’t bottleneck 
it by continuing to second-guess all the decisions that the experts 
have made as they have been working through this process. 

Regarding whether we can duplicate North Carolina, I believe we 
will end up looking something like what you saw in North Caro- 
lina. And, by the way, we very much appreciated your time to come 
down and look at the facility. I think the computer space will be 
about the same size. 

I think this building will have some more robust infrastructure 
to it. You may remember going down in those industrial rooms in 
the basement of the building in North Carolina. I think the new 
one will have more size and heft in the industrial part. But ulti- 
mately, I think it will look a lot like what you saw in North Caro- 
lina. 
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But we are really going to rely on the expert designers and archi- 
tects. Also, we are looking for a lot more energy efficiency in this 
building, even more so than what you saw in North Carolina. 

Chairman JOHNSON. Well, do they have all the equipment to 
fit the building out when we get it done? 

Mr. CROFT. Well, no. We will have to go through a very long 
process to actually move all that equipment that you saw in Balti- 
more into 

Chairman JOHNSON. You are not going to use that old stuff, 
are you? 

Mr. CROFT. I am going to use some of it. Right. I am not going 
to use stuff that is obsolete. But some of it is very current and very 
modern, and it would cost a lot of money just to set aside equip- 
ment that still runs well. 

Chairman JOHNSON. Well, it is going to cost to move it, too. 
Thank you for your comments. 

You are recognized, Mr. Chairman Denham. 

Mr. DENHAM. Thank you. 

Mr. O’Carroll, the uninterrupted power supply system that sup- 
ports the power of the current facility is over 30 years old. Many 
of the parts are no longer manufactured, and the service contract 
expires in 2012, well before the new data center will be completed. 

You described the importance of the UPS system in the SSA 
plans to do — what are you going to do after 2012? 

Mr. O’CARROLL. Chairman, on the technical part of it, I am 
going to defer to Mr. Croft. 

But on the oversight part of it, which is what we have been 
doing, Lockheed Martin did a study on the NCC. They identified 
the uninterrupted power supply as an issue. There is a single 
source of power going to the NCC at the moment, which is another 
risk. 

And what we are concerned with is the aging of the uninter- 
rupted power supply that they have. I am told that SSA has en- 
gaged with a contractor that is going to be able to extend the life 
of the uninterrupted power supply that they have. 

And then also, we are monitoring SSA’s progress in getting an 
alternate source of power, which we highly support. 

And I will let Mr. Croft give you more of the technical details on 
the uninterrupted power supply. 

Mr. CROFT. Yes, Mr. Chairman, just a general comment. We 
have done an awful lot of things to the building that have extended 
the capacity, if you will, of electrical distribution in particular, 
which was the main concern with that 2012 date that you ref- 
erenced in your question. We have taken action to mitigate that. 
So that is not one of our major concerns at the moment. 

But our major concerns are things like uninterruptible power 
supply, the plumbing in the building, the HVAC in the building, 
the fire suppression. These are original to the building, and we will 
do what we can to maintain them, but the longer we go, the higher 
risk there is that they will fail. 

Mr. DENHAM. And if the system does fail, how long would the 
North Carolina system be able to fully support the entire process? 

Mr. CROFT. It will be able to support us indefinitely. The issue 
then, Mr. Chairman, would be that we would be left without a 
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backup to that. So we would have to be scrambling to come up with 
a viable backup to North Carolina at that point. 

But the center in North Carolina is big enough now — has enough 
capacity — to be able to run the critical systems of the agency. And 
with a little bit more time, we would even be able to bring back 
our non-critical systems in the agency. So it is our ultimate risk 
mitigation. 

Mr. DENHAM. Thank you. 

And Mr. Foley, I thought you said in your testimony that this 
project would be on budget and on time? 

Mr. FOLEY. We will meet our milestones from this point for- 
ward. Obviously, there have been some delays, and we are looking 
to make up the time. But as far as budget, yes. We are still on 
budget. 

Mr. DENHAM. And time, even after the one-year delay? So you 
don’t plan on making up the one-year delay, but you do plan on 
being on time this point forward? 

Mr. FOLEY. Yes. As far as physical construction of the factory, 
we are about 11 months behind our original schedule. But we be- 
lieve we can make that, and we are looking for every opportunity 
to accelerate, if possible. 

Mr. DENHAM. So final completion of construction? 

Mr. FOLEY. September of 2014. 

Mr. DENHAM. And up and running completely, 100 percent 
transition? 

Mr. CROFT. We would take keys to the building — to use my 
term — in January of 2015 because, as David said, there would need 
to be testing of the building systems to make sure that they were 
ready to accept the equipment. 

And then we will transition in phases. We have said it will take 
us up to 18 months to transition the entire facility over. We will 
be running out of both facilities for some period of time. We will 
do everything we can to beat that 18-month period, and as we get 
closer, we will do a lot more precise planning and see how well we 
can do to beat 18 months. 

Mr. DENHAM. And at what point was this project started, or the 
need identified? 

Mr. CROFT. I believe it tracks back to a study that would have 
come out in early 2008. 

Mr. DENHAM. So nearly a decade, by the time it was identified 
and the new system will be up and running. 

Just a couple quick followup questions to Mr. Foley. In your site 
selection, any other existing properties that you identified that are 
existing public properties today? 

Mr. FOLEY. We did screen for available public properties. The 
Woodlawn campus, obviously, was the most logical choice, and we 
did study that. But as I mentioned in my testimony, because of the 
additional risk due to schedule, cost, and disruption of critical serv- 
ices for SSA, we decided that a new site would be more appropriate 
and would allow us to deliver the facility more quickly. 

Mr. DENHAM. No other public properties anywhere in the area? 

Mr. FOLEY. We did screen through them. I don’t know the spe- 
cific sites that we looked at. 
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Mr. DENHAM. I would like to see a list of the specific sites and 
how you went about that process. 

Chairman JOHNSON. Thank you. 

Mr. Becerra, you are recognized for five minutes. 

Mr. BECERRA. Thank you, Mr. Chairman. 

And thank you to the three of you for your testimony and con- 
stant vigilance on this issue. I want to say that we appreciate that 
you have been very forthcoming in the constant efforts that we 
have engaged in within this committee to try to work hand in hand 
with you to move forward with this project. 

I think everyone understands how important it is to get it done 
right. We can’t have any kind of failure, the way we saw with the 
IRS with its computer system, because in your case, people on a 
monthly basis depend on you being able to operate. So we thank 
you for the work you have been doing. 

I also want to mention that I know that we worked hand in hand 
with you in the whole process of site selection. We were somewhat 
concerned that you go forward with the best site, and so I know 
that especially in 2009, we were constantly asking, are you sure 
you are going to do it the right way? Are you sure you are going 
to have good sites to select from? 

So I want to thank you for having gone through the additional 
analysis that you undertook. And I suspect we probably feel more 
confident today that the site that was selected was the best site 
that we could go with. Is that the case? Yes? 

[A chorus of ayes.] 

Mr. BECERRA. Good. Do you have the funding that you need to 
continue to move forward? Yes? So if we could just say that for the 
record. Mr. Foley? Mr. Croft? 

Mr. FOLEY. Yes. For the construction phase, we do. 

Mr. CROFT. Yes, sir. We do. 

Mr. BECERRA. Are you still on budget? I think I heard you, Mr. 
Foley, say that you are still on budget? 

Mr. FOLEY. We are. 

Mr. BECERRA. So because we took a while on that site selection, 
that moved us back a ways, about a year, in terms of when you 
would complete the project. But in terms of the budget, you feel 
like we are still on budget? 

Mr. FOLEY. Yes. 

Mr. BECERRA. Good. And the consequences: If you didn’t have 
your money, what would happen if you didn’t have the money to 
move forward? 

Mr. FOLEY. I mean, obviously, if we didn’t have the money to 
move forward and award construction, the project would grind to 
a halt. I think as far as the consequences on operations, I would 
leave that to Mr. Croft to discuss. 

Mr. BECERRA. Mr. Croft. 

Mr. CROFT. Well, sir, if the project came to a halt, the risk 
would just continue to grow of a significant failure with the current 
building. It is that simple. It is a risk-based decision. It gets worse 
and worse the longer we go. 

Mr. BECERRA. And I know the initial estimates of the first data 
center were that by 2013, you would max out on capacity. And I 
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know you have done some things to gain some additional capacity 
there, and we now have the second site, which helps us. 

But even then, you need to have that redundancy so you can 
move forward. So if you have collapse at one site, while you could 
continue after, as you say, four days to get back up and running, 
you are still not running the way, operationally, we would want to 
have a center that controls so much data would have to. 

Mr. CROFT. Yes. In the four-day time frame, we use the term 
“critical systems.” And these are the core systems that, in your dis- 
tricts, your field office staffs use to process the claims and do all 
the things that the public is really looking for. 

We have other activities and systems that are important to us 
but would not be in that four-day critical period of recovery. For 
example, we would bring up some of our management information 
systems and things like that. 

But yes, we do have the capacity in the second site now to be 
able to recover all of that. 

Mr. BECERRA. Not only would you go down, I suspect pretty 
much every one of our district offices would go down as well be- 
cause I doubt that there are many offices that don’t handle, as a 
significant part of their work, these Social Security claims, dis- 
ability and otherwise. 

Mr. CROFT. Right. They could still interact with the public. If 
the outage was going to be for a full four days, they could take 
claims, conceivably, on paper the way we used to in the olden days. 
But then they would have to transcribe it back 

Mr. BECERRA. Don’t take us back to those olden days, please. 

Mr. CROFT. Right. I mean, they could. We wouldn’t be shut 
down. They would still talk to the public. They just wouldn’t be 
able to actually transact anything. 

Mr. BECERRA. Let me ask one last question, and I think, Mr. 
Foley, you probably can answer this best. Given the extensive work 
that was done in selecting the site, do you anticipate any protests 
at this stage on the selection itself? 

Mr. FOLEY. I believe we learned last night that there has been 
a GAO protest filed. I think the important part for us to focus on 
is that the site selection is not on the critical path at this point for 
the procurement. We are moving forward with a two-phase source 
selection, and so the first phase is all about finding qualified con- 
tractors who can design and build this facility. So we can narrow 
that down to the most qualified candidates. 

So we do anticipate — and I believe there has been a protest filed. 
Based on the process that we used, we are confident we will prevail 
on that protest and that it won’t impact the schedule at this point. 

Mr. BECERRA. Do you mind, please, keeping this committee in- 
formed about the progress on that protest and any protests that 
may come along the pike? 

Mr. FOLEY. Absolutely. 

Mr. BECERRA. Thank you very much. 

I yield back, Mr. Chairman. 

Chairman JOHNSON. Thank you, sir. 

Ms. Holmes Norton, would you care to comment? 

Ms. NORTON. Thank you, Mr. Chairman. 
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Last thing we want is more delay on this project. But remem- 
bering that what concerned both subcommittees before was site se- 
lection, I am concerned with the report that we got just yesterday 
from the inspector general and with reconciling what is in that re- 
port with the testimony of Social Security; specifically, the change 
in the criteria used in site selection, which you, Mr. O’Carroll, indi- 
cate is somewhat problematic. 

For example, the three finalists, three final sites, have one, two, 
and even three secondary criteria, while several of the unsolicited 
sites had only one documented secondary criteria conflict. Now, you 
changed, apparently — the team changed some mandatory to sec- 
ondary. 

Now, to keep us from talking jargon, Mr. O’Carroll, Mr. Croft, ex- 
plain what secondary and mandatory are, and why the team in the 
process of selection would change from one category to another, or 
recategorize in the way you did. 

Mr. O’CARROLL. Congresswoman, I will take the first crack at 
it before I turn it over to Mr. Croft. 

There are a couple issues, and you said that probably the biggest 
one is documentation. And our concern, as we have been moni- 
toring this project throughout, is with a couple things. 

One, we don’t sit at the same table with GSA and SSA as these 
decisions are being made. And that is probably good for the sake 
of independence. We are not part of the process. We are just evalu- 
ating it. 

One of the biggest concerns with regard to evaluating it is the 
timely receipt of the information. And then also, the documentation 
that we get. And that is where a couple of our issues have come 
up — the documentation on the decision-making. Many times the 
documentation has been lacking. 

And another issue is that we try to be ahead of the curve. One 
of the biggest complaints about inspectors general is what they call 
the “gotcha” mentality, that we wait until things go wrong and 
then we point it out. What we are trying to do here is point out 
issues before they go wrong. 

We have had a couple instances where by the time we got the 
information, a decision has already been made. And that is what 
happened with this report — the decisions had been made. The site 
had been selected. And subsequent to the decision, we issued our 
report where we flagged the issue. A year ago there were 14 dif- 
ferent sites that were being evaluated, and they were being dis- 
carded based on different secondary criteria and primary criteria 
that were being considered. They kept narrowing it down. And 
then it got down to the three sites. 

And what our concern was, was there any one of the ones that 
were discarded beforehand that would have been better than the 
three that were selected? And that is what the substance of our re- 
port was. 

Ms. NORTON. Well, it raises a question, and maybe Mr. Croft 
and Mr. Foley can make us understand it. It raises some question 
when you change the criteria. You know, you change the criteria 
in the middle of the game and you can get any site you want. 

So changing criteria is very bothersome. And I would like to 
know why the criteria for site selection would change in the midst 
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of site selection. I mean, that is pure and simple what I am inter- 
ested in. 

Mr. FOLEY. I will answer first because I think a lot of the site 
selection process falls under GSA. 

Ms. NORTON. Yes. 

Mr. FOLEY. As far as changing the primary and secondary cri- 
teria for the site selection, it was done very early on the proc- 
ess — 

Ms. NORTON. So give us examples of primary and of secondary. 

Mr. FOLEY. Primary are sort of the critical go/no-go. So does the 
site have the appropriate infrastructure? Can it provide the utili- 
ties to the site? All of those sorts of things. Secondary criteria are 
things like access to the site and other criteria that are nice to 
have but not critical to the operation of the factory. 

And so as we were beginning the process and before we began 
evaluating any of the offers, we recognized that some of the criteria 
that we had as primary criteria were narrowing the number of 
available sites. We wanted to maximize competition, and we looked 
for other ways to mitigate some of the risks that were raised by 
some of these primary criteria. 

So before we did any evaluation of any of the sites, we did 
change one of the criteria to a secondary. But that was really done 
so we that could maximize the number of available sites and the 
competition and find the most appropriate site with the least 
amount of risk so we could deliver it as quickly as possible for SSA. 

Ms. NORTON. Generally, when GSA builds — am I out of time? 

Chairman JOHNSON. You can go ahead and ask one more. 

Ms. NORTON. I will just ask this remaining question, then, and 
I thank you for your indulgence, Mr. Chairman. 

Generally, of course, when GSA puts out an RFP, one of the cri- 
teria is proximity to mass transportation. Is there any proximity to 
mass transportation? Do these workers have proximity to mass 
transportation where they are now located? How will they get to 
the site? 

Mr. FOLEY. I would defer to Mr. Croft on the current mass 
transportation. We did evaluate all of the sites. The data center is 
a little bit of a unique facility in that the density and utilization 
and number of employees is less than, say, a typical office building 
that GSA 

Ms. NORTON. How many employees? 

Mr. CROFT. In the new facility, my staff would be about 79, and 
then there would be additional facility staff, guards, things like 
that. And remember, these are three shift, 24/7 operations. 

Chairman JOHNSON. Tell you what, the gentlelady’s time is ex- 
pired. Can you submit that answer in writing? 

Mr. FOLEY. Certainly. 

Ms. NORTON. Thank you, Mr. Chairman. 

The projected number of employees for rotating shifts at the na- 
tional Support Center (NSC) to provide coverage 24 hours a day, 
7 days a week, and 365 days a year is 208. Of these, 97 will be 
Federal employees and 111 will be contractors. 

Chairman JOHNSON. Mr. Brady, you are recognized. 

Mr. BRADY. Thank you, Chairman Johnson, Chairman Denham. 
Thank you for hosting this hearing. Nice to see you again, 
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Mr. O’Carroll. Appreciate it. Look forward to working with you 
again this session. Mr. Foley, Mr. Croft, thanks for being here. 

You know, our seniors just depend upon getting their checks on 
time and accurately, plus Social Security and the data you have 
play a critical role with other federal, state, and local agencies. So 
this is a critical issue. 

When natural disasters in California collapsed roads and bridges, 
when the Minneapolis bridge, an 1-35 construction flaw, collapsed, 
the Federal Government worked with remarkable speed, knowing 
that truly they didn’t have an option and they needed to move 
quickly. 

I am not saying we have a natural disaster on our hands. But 
obviously, we are on borrowed time with the aging NCC system as 
it is today. Mr. Foley and Mr. Croft, why can’t we apply those prin- 
ciples to getting this project back at least to its original timetable 
in moving forward just to ensure that we have bought ourselves 
again more time to prevent anything from happening that really 
would have pretty critical impacts? Mr. Foley? 

Mr. FOLEY. Certainly. As I said, we are committed to looking for 
every avenue to accelerate, and we are exploring all those. I think 
we have an aggressive schedule for the delivery of the data center 
on the construction side. And, you know, as with any project, there 
are clearly components of risk as we move forward through the pro- 
curement phase and through the construction phase. 

But we are taking every step we can to mitigate those. So on the 
procurement side, we have detailed criteria, and we have a well- 
established process for the procurement, and we are confident that 
we can move through that quickly without any delays. 

On the construction side, the two components, typically, where 
you see opportunities for delay are when you have an issue with 
the contractor. And so by going for the two-phase source selection 
where we get only the most qualified contractors, we think we are 
mitigating that risk as we move forward. The second phase or the 
second place where you often see delay is in changes in require- 
ments, and we have worked extremely closely with Social Security 
to ensure that we have a well-developed program of requirements. 

And so I think we are — we don’t anticipate any further delays. 
And as I said, we are looking at all avenues we can to accelerate 
on the construction side, and I think on the migration side as well. 

Mr. BRADY. On the construction side, of the elements that go 
into, both acquiring the site, designing and building, construction, 
as you said — and obviously, Mr. Croft, you have got the installation 
as well — what are the greatest risk factors for further delay in your 
experience with other projects? Where do we see the most risk in 
something slowing us down further? 

Mr. FOLEY. I mean, I think I mentioned them previously. The 
two places where we see risk are during the procurement, where 
you have a risk, potentially, for a protest among the unsuccessful 
bidders 

Mr. BRADY. And how much could that delay it? 

Mr. FOLEY. I think we are hopeful that we can move through 
that process fairly quickly. You know, it could be a matter of 
months to just a matter of weeks. We know we have got a good 
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process in place, so we hope to keep that to a minimum and we 
hope we wouldn’t have any protest on the award. 

On the construction side, the biggest risk is typically where you 
have changes of requirements. So as you get through the design 
and into construction 

Mr. BRADY. And does that hinge, really, on the coordination be- 
tween Social Security and GSA? 

Mr. FOLEY. Absolutely. And that is where our close working re- 
lationship has proved beneficial. We have a well-detailed program 
of requirements, and we are working in close coordination to make 
sure that we don’t have any delays as we move through the con- 
struction side. 

Mr. CROFT. Mr. Brady, I echo what David said. We have in- 
vested massive amounts of time working with the GSA team to 
make sure that that program is complete and will not be an im- 
pediment to this project. 

So we are very, very much in the middle of this, and we will com- 
mit to keeping up with our colleagues from GSA. 

Mr. BRADY. Thank you. What is the degree of certainty that we 
will get this building to Social Security in January 2015? And what 
is the degree of certainty we will finish the IT and systems 18 
months later? 

Mr. Foley, is it 100 percent? Ninety percent? Eighty percent? 
Seventy percent? Your experience with other projects, what should 
we expect? 

Mr. FOLEY. Based on my experience, we do have an aggressive 
schedule, in part because we recognize the criticality of this. I 
think because of all the coordination and in part because of some 
of the environmental work and things that we need to know a little 
extra time up front, we are fairly confident that we can certainly 
deliver within the schedule we currently have and because of the 
risk mitigation that I mentioned up front. 

Mr. BRADY. How comfortable? 

Mr. FOLEY. We are very comfortable we could deliver that. 

Mr. BRADY. Eighty percent comfortable? A hundred percent 
comfortable? 

Mr. FOLEY. I would say at least 80 percent and more. 

Mr. BRADY. I knew you didn’t want to give that number. 

[Laughter.] 

Mr. BRADY. But for our own sake, I wanted to know just what 
this comfort level was. 

Mr. FOLEY. I had to try. 

Mr. BRADY. I am over time, Mr. Chairman. Do you want to an- 
swer quickly, Mr. Croft? 

Chairman JOHNSON. Thank you. Go ahead. 

Mr. CROFT. Well, for IT migration, I am extremely comfortable 
that we can make it within the 18-month time frame. And I am 
not a betting person, but I would bet we will substantially beat it. 

Chairman JOHNSON. Well, I am concerned that you are moving 
some of the equipment from the old facility to the new one, and I 
don’t know how you are going to make that transition on time. I 
hope you can. 

Mr. Stark, do you care to question? 

Mr. STARK. Not at this point, Mr. Chairman. 
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Chairman JOHNSON. Thank you. 

Mr. Paulsen, do you care to 

Mr. PAULSEN. Thank you, Mr. Chairman. 

Chairman JOHNSON. Thank you. 

Mr. PAULSEN. I just have maybe a couple of questions. Part of 
it has been the reassurance, obviously, of the members of this com- 
mittee, and I am just learning about the timelines that are around 
the data centers that are out there. But let me just understand, 
maybe, some more of the impact because I am learning exactly all 
about the Social Security and the data that is kept there. 

But Mr. Croft, knowing that what you are doing right now, you 
are doing everything possible, right, that you can to prevent the 
aging NCC from failing, if it were to fail this year — let’s just say 
it failed. And I know there is a four-day backup plan that comes 
up. And I visit my local Social Security office the next day. 

I mean, what would I find if I went in there the next day after 
a failure? Would I be able to file a claim? Would I be able to change 
the bank to where my checks get sent? Would I be able to do that? 
Would I be able to file an appeal that day if a claim was denied, 
for instance, or would it take a long period of time? Just help me 
sort out what might happen. 

Mr. CROFT. Yes, sir. I appreciate the question. 

First, if we had a situation like that, one of the first things we 
would be doing, of course, is communicating, not only to our own 
management team and workforce but also to the communities. We 
would be sending out information about the likely outage and the 
impact on operations. And for people that can wait to come file a 
claim or do things with us, we would be encouraging them to wait 
until we are back up and operational. 

If you came into the office, though, and our systems were down, 
you could file a claim. We couldn’t process it, though. You could file 
a claim on paper. We might take information from you to protect 
your filing date to make sure you don’t lose any benefits and so 
forth. 

We could take information from you related to changing a direct 
deposit, but we couldn’t actually process that, either. We would 
wait until the system was up, and then we would have to work to 
key that information in and process it at that time. 

So we would be there. We would be able to talk to people. We 
could take information from people. We could actually take paper 
claims and things like that. But we could not process them until 
the system was back up. 

Mr. PAULSEN. So it sounds like essentially you are going to 
have a backlog occur until everything starts up again? 

Mr. CROFT. A tremendous backlog would build up very quickly. 

Chairman JOHNSON. Mr. Croft, can I interrupt you a minute? 
I thought you told me that a certain percentage of the system was 
running in Carolina now. 

Mr. CROFT. It is. That is correct. 

Chairman JOHNSON. And those would not be affected, would 
they? 

Mr. CROFT. Yes. The things that are in Carolina would not be 
affected. That is correct, sir. 
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Chairman JOHNSON. So take the State of Texas, for example, 
which you are doing down there. If the main center went down, 
Texas would not be affected. Is that true? 

Mr. CROFT. What we showed you there was the printing of So- 
cial Security cards for Texas. We could still print Social Security 
cards if we had the new information coming in. The main thing 
that is in North Carolina is all the medical evidence associated 
with our disability process, which is a huge growth area for us. 
That would still be up and operational. 

But a lot of the online types of system and the claims systems 
that the question referred to, they are dependent on the National 
Computer Center at this time. So they would be down under the 
scenario that the question 

Chairman JOHNSON. For four days, according to you, five ac- 
cording to him? 

Mr. CROFT. Four days to me, and working towards one. 

Chairman JOHNSON. Thank you. 

Mr. PAULSEN. Mr. Croft, let me just follow up, too. So if I am 
a business owner and I am using the E-Verify system, participating 
in that — that is the voluntary program that allows me to verify 
work authorization of my new hires — will I be able to verify new 
hires during that time frame? 

Mr. CROFT. Yes, you will. That is one of the redundant systems 
between the two data centers. If it happened tomorrow, it would re- 
quire some additional work from our colleagues at the Department 
of Homeland Security (DHS) to point their system to North Caro- 
lina. But we are all set up and ready to do that. 

Mr. PAULSEN. And if I was going to call on like the 800 num- 
ber, for instance, would I get an answer on the phone? Would I be 
able to conduct business or be a part of that? 

Mr. CROFT. Yes. Yes, sir. Our phones would work, but our staff 
would have limited ability other than to talk to you and take infor- 
mation from you. For example, they would not be able to pull up 
your master beneficiary record to answer questions with specificity 
about your claims or your benefits. 

Mr. PAULSEN. And maybe just I will close here. But let me ask 
you this, too. With the timelines, and you say you are reasonably 
sure that you can meet the current timelines even though we have 
already been delayed, but if everything is completed with the new 
center and there was an outage, is it going to be the same four- 
day backup? Or is it going to be we are going to have a backup now 
and we are not going to have that time frame to meet an emer- 
gency if there was an outage? 

Mr. CROFT. Yes. We are at a four-day recovery time now, and 
we have an active project, irrespective of the replacement data cen- 
ter project, to drive that down to one day. And we will make that, 
as we have said, by the end of fiscal year (FY) 2012. And I believe 
we will actually beat that one as well, Mr. Johnson. 

But we will be driving that down. So we will be at a one day re- 
covery time if either of our centers fail. 

Mr. PAULSEN. Thank you, Mr. Chairman. 

Chairman JOHNSON. Thank you. 

Ms. Berkley, do you care to question? 
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Ms. BERKLEY. I do indeed, and thank you very much for hold- 
ing this hearing. And thank you, gentlemen, for being here. 

We are in the process of building a VA medical center in my con- 
gressional district. There are three buildings 147 acres, and it is 
the first new construction in the VA in 20 years. It is a massive 
undertaking. So I very much appreciate what you are doing and 
how you are doing it. 

One of the questions that many people in my community would 
ask when we got the timeline on how long it would take to build 
these facilities was if we could build a 5,000-room hotel in Las 
Vegas in 18 months, how is it that this is going to take so long? 

But now that it is nearing completion and I see what went into 
creating these buildings, I understood why it took as long as it did. 
So I fully appreciate your need to do your due diligence and 
produce a building that is going to not only be functional and safe, 
but will be with us for many decades to come. 

I also realize how challenging site selection is because I grew up 
in my congressional district. I know every inch of it. And I had 
many suggestions for the appropriate site for this VA medical cen- 
ter. And as each one of my suggestions was shot down, I also came 
to appreciate that even though it was not even on my radar screen, 
the site that we chose was perfect for the function of these build- 
ings. And we are going to be creating a whole new city within a 
city once this is up. So I want to thank you for doing your work. 

We were able to build this VA center with a $600-million ear- 
mark. And I am a great proponent of earmarks, although they 
seem to have fallen out of fashion lately. But what I was astounded 
is when we were talking about it being on time and being on budg- 
et, and I thought that was just great. 

A few years after the start, I came to realize that there was an- 
other $100 million that was needed for equipment and furniture 
and training and hiring, because we are going to be hiring a thou- 
sand people. 

Do you need additional resources from the Federal Government? 
Do we have to appropriate it? Is it now up to your Social Security 
Administrator to come and make the request? Where are we in 
that process? 

Mr. CROFT. Yes. Thank you. Out of the $500 million that have 
been appropriated for this project, $100 million is to be used as the 
down payment, if you will, for the actual outfitting of the building 
with IT, the transition of the IT, and so forth. 

And at the time that this was done, we estimated that it could 
cost upwards of $350 million altogether to do a full transition from 
the old building to the new. So what we will be doing is making 
requests as part of our budget process. 

I believe you will start seeing requests from us, based on current 
timeline, in FY 2013/2014/2015, possibly 2016 as well, to cover the 
additional costs associated with transitioning all of the IT from the 
old building into the new and establishing that as a fully func- 
tioning new data center. 

Ms. BERKLEY. And I am glad you brought that up because 
there have been a couple of questions asked about the effectiveness 
and the cost-effectiveness of transferring existing equipment from 
the old building to the new. 
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I am sure you have done a cost study on this, and is it less ex- 
pensive to do this than purchase new? 

Mr. CROFT. It will be for equipment that still has a lot of 

Ms. BERKLEY. Life? 

Mr. CROFT. Correct. That is right. And we will be doing much, 
much more precise planning, actually starting later this year and 
getting into next year, as we actually are getting closer and closer 
to being able to take over this facility. 

We will develop a master plan. We will start working through 
our budget cycles. We buy a lot of things, a lot of hardware, a lot 
of IT equipment anyway. What we’re trying to do is time our reg- 
ular refreshments of equipment. 

If we can extend some of our equipment a little bit longer in the 
old building so that we can just ride our normal budget cycles for 
equipment that we were going to replace anyway and have it go 
directly into the new facility, that will be a way for us to cut down 
on that cost and make it go smoother. 

Ms. BERKLEY. Thank you. 

Mr. O’Carroll, in my final moments, seconds, you know the situa- 
tion in my district, with the unprecedented growth and the amount 
of backlog we have and the lines that we have. If we roll back our 
budgets to 2008 numbers, what will that do to the people in my 
congressional district that depend on Social Security? 

Mr. O’CARROLL. Congresswoman, I think that is an issue that 
Social Security is looking very hard at — what is going to happen to 
customer service. When you take a look at the last two years, the 
growth that SSA has had, the expectations now of the public are 
higher because backlogs have dropped, service has improved. If 
there are going to be budget cuts obviously it is going to have an 
effect on customer service. 

One other thing we are always very concerned with is steward- 
ship. One of my concerns is that stewardship not decrease. SSA 
should do its due diligence to make sure that the right people are 
getting the right benefits, and that that doesn’t suffer, because of- 
tentimes stewardship suffers whenever customer service gets high- 
er priority. 

Ms. BERKLEY. So penny wise and pound foolish? 

Mr. O’CARROLL. Yes. 

Chairman JOHNSON. The gentlelady’s time has expired. Thank 
you. 

Mr. Smith, you are recognized. 

Mr. SMITH. Thank you, Mr. Chairman, and thank you to the 
panel for sharing your expertise and insights here. It has been in- 
teresting to listen to this now that the 2008 spending levels have 
been injected into this hearing and the stimulus funds and so forth. 

But I can’t help but think that the whole process — and I am fair- 
ly new to this project — but looking at the delays, and then the 
extra funds being directed to that and maybe not even speeding 
things up — and I don’t want to go there necessarily. I am curious 
as to how the process could be streamlined in the future. I have 
talked to private contractors who say that government projects 
tend to take a long time, therefore cost more money, or vice versa. 

And so if you could speak to something that could be done, per- 
haps — and maybe not even being able to respond to that today, but 
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for the record in the future — how can we get to the bottom of some 
of these things, the delays? And I am not faulting any one par- 
ticular person or agency. 

It is just that there seems to be so much placed into the decision 
that it becomes so burdensome. Then it is delayed. It is more ex- 
pensive. Service perhaps could suffer, and efficiency overall is lost. 

Can any of you speak to that in a brief moment? 

Mr. FOLEY. I will take the first shot at it. I think there are 
unique requirements to building a federal facility. In particular, 
the data center is a complicated facility unlike a traditional or typ- 
ical office building, even the ones that GSA builds for many of our 
other customer agencies. 

So the timeline on this project is longer just simply because of 
the type of facility. When you are building a $400- or $500-million 
project, including equipment and all the technology that has got to 
go into there, the building mechanical systems are much more com- 
plicated. The phasing and sequencing is much more complicated. 
And so it does take a longer period of time. 

There are also requirements that the Federal Government has 
for additional security — redundancy on the systems, which I defer 
to my colleague at Social Security to discuss a little more — but that 
are more complicated, require more due diligence than perhaps a 
typical private sector facility might go through. So I don’t know if 
you 

Mr. CROFT. I appreciate your question. I am not an expert on 
this process. I do find it daunting, and I really respect my col- 
leagues for the way they maneuver through it. It is an extensive 
process, and I don’t have words of wisdom about it, to be honest, 
Congressman. 

Mr. O’CARROLL. Mr. Smith, I am also in that same position — 
what we are doing is monitoring. What we are trying to do with 
our monitoring process is not to impede, not to delay the project, 
and do everything that we can to keep it on schedule. 

But we have the same role of oversight. So I guess the best thing 
I can say, Mr. Smith, is I can assure you that the oversight role 
isn’t going to be a lag indicator on the future of this project. 

Mr. SMITH. Okay. Thank you. Thank you, Mr. Chairman. 

Chairman JOHNSON. Just know that I understand duplication 
in effort in these kind of buildings. And there is a lot of technology 
going in there, and backup power, backup generators, backup this, 
backup that. And it is great that you are considering all those 
things. 

Mr. Rangel, do you care to question? 

Mr. RANGEL. Mr. Chairman, thank you, and Congressman Nor- 
ton for having this hearing. I only want 

Chairman JOHNSON. Microphone. 

Mr. RANGEL. I only want to take advantage of this moment to 
thank the panel of the great job that they are doing for hundreds 
of millions of Americans that we don’t say thank you enough. But 
their lives and their families have been affected. 

And I think the Social Security Act is one of the highest mo- 
ments of our nation and the Congress. And continue your good 
work, and count on our support. 

Thank you, Mr. Chairman. 
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Chairman JOHNSON. Thank you, sir. You lost your words, huh? 
You can talk longer if you want to. 

Mr. RANGEL. No, no. I really think, when you are hearing 
things positive, progress is being made, you don’t go backwards. 
You just thank them and move on. 

Chairman JOHNSON. They do do good work in my view. 

Mr. Berg, you are recognized. 

Mr. BERG. Thank you, Mr. Chairman. Again, I want to thank 
you for all the work you put into this. In my real life I am involved 
in commercial real estate, and so I am somewhat familiar with the 
private sector. 

And I just had a couple of just big picture questions. How big is 
the facility, and what is our cost per square foot in the new facil- 
ity? 

Mr. CROFT. I believe the building will be approximately 400,000 
gross square feet. 

Mr. FOLEY. I think it is, 400,000 square feet. And I think the 
overall total construction cost, including management and inspec- 
tion and the design services, is about $381 million. So I don’t have 
my calculator here to do the quick math, but we can certainly pro- 
vide the estimated construction cost per square feet for you. 

Mr. BERG. Well, obviously, one of the things that is of concern 
to everyone here is what might be in jeopardy if we have a crash 
in the current facility, and really what is going on. 

The other thing that I see is obviously our economy is in a slump 
now. And we look at this project and we say, when will the bulk 
of the jobs actually be out there receiving paychecks, and how can 
we speed that up? 

And I am not going to go through all the timetable and every- 
thing you are doing because again, as you look at that, we can 
argue about that and talk about that. But in my experience — and 
I am just going to kind of lay out an analogy. I don’t know if this 
is true or not. 

But I think when it comes to government projects, there is kind 
of a private sector construction world out there, and there is kind 
of a way they do things, whether it is a data center or office build- 
ing or warehouse, that they have timetables and what they go 
through. 

And to some degree, it seems like through the government, when 
we are doing construction projects, we are saying, okay. We don’t 
really care about how the industry normally does this. We are the 
government, and here is how we do this, and we are so concerned 
about having everything accounted for and everything competed for 
that we end up, in my opinion, sometimes taking twice as long for 
a construction project that ultimately costs us more because of the 
delays. 

My other concern is in our effort to make everything fair for 
every contractor, we end up not having that many contractors com- 
pete because they are like, I don’t want to do all that paperwork 
and spend hundreds of thousands of dollars to get in the game 
when there is only a 10 percent chance that I will get it. Instead 
of doing that, I am just going to do my normal work. 

So maybe just — again, I am kind of stepping back. And not to 
pick on this project, but if we were going to kind of rethink how 
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we do major construction projects like this in a way that would be, 
again, two years rather than five years, I am asking for ideas or 
what you might think could be done differently from out standpoint 
to deliver, again, the same results, but faster. 

Mr. FOLEY. Sure. I think that first I should note we have 
brought in expertise from the private sector, from folks who build 
data centers all the time, because this is a unique, highly com- 
plicated project. 

So we are using our expertise, SSA’s expertise of their require- 
ments, and we have brought in consultants who are experts in 
terms of data centers to help with that, to make sure that we 
aren’t adding things to the process and help make sure that we do 
that. 

As far as your concern about how do we make sure that we get 
competition because of the process and all of that, that is one of 
the benefits of our two-step source selection, where we don’t re- 
quire as much detail up front before we narrow the list down. 

So you get to a short list of folks, so they know I am not one of 
50 competing. I think, based on our experience with other Recovery 
Act projects, we are confident that we are going to get good com- 
petition on this project. 

And so I think there are differences between private sector and 
government, but we are always looking for opportunities and ways 
that we can streamline, and do it in the most efficient manner. But 
we do have certain rules, regulations, and a certain duty as the 
Federal Government to make sure that there is a fair opportunity 
for all entities to compete in this. 

Mr. BERG. Mr. Chairman, let me reask that question. First of 
all, I am not asking you to defend anything. 

Mr. FOLEY. Okay. 

Mr. BERG. I trust that you are making a good decision. I trust 
that you have great contractors. I understand the process, and 
someone can have a dispute or a protest and it screws things up. 

My question to you is, again, on the big picture, if we said this 
had to be done in two years rather than five years, is there any- 
thing that you can think of that says, you know, we could stream- 
line this by removing some of these obligations or requirements? 
That is my question to you. 

Mr. FOLEY. I mean, I think the longest parts in the process are 
through the environmental phase, which you are well aware of, you 
know, through any private development as well. Through the pro- 
curement, there are additional rules and regulations that do take 
a little bit longer for the government because we do have to have 
full and open competition as opposed to being able to go out to two 
or three contractors and say to do that. And so that does add time 
to the process. 

As far as construction goes, we are hiring a private sector con- 
tractor to build the building, and so I hope that our actual con- 
struction time frame and the process we are using, design/build, 
is — it is common practice in private sector real estate. And so I 
think that portion of the process is fairly similar. So I think it real- 
ly is on the front end where it is a little bit different. 

Mr. BERG. Thank you. Just one followup? Or am I out of time? 

Chairman JOHNSON. Go ahead. What have you got? 
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Mr. BERG. My question is, what is the plan for the property that 
you are going to be moving out of? 

Mr. FOLEY. Sure. 

Mr. BERG. And that may have been already addressed. If so, I 
apologize; you don’t need to respond to that. But we don’t want to 
wait. 

Mr. CROFT. No. It hasn’t been asked, sir. We are going through 
a master planning process on the campus. The building will stay 
in use. It probably will need to have some renovations once the IT 
is out of it. Again, the plumbing and all that stuff is original to the 
building. 

My speculation would be it will be an office building for Social 
Security workers in Baltimore. 

Chairman JOHNSON. Yes. That is another issue we need to look 
at. Thank you for bringing it up. Your time is expired. 

I am going to allow Mr. Denham, the chairman, to ask one more 
question. 

Mr. DENHAM. Thank you, Mr. Chairman. Actually, my question 
is the same as Mr. Berg’s question, which I don’t think was fully 
answered. I understand that there is going to be tenant improve- 
ments on the facility, on the building itself. But this is a 260-acre 
piece of property, is it not? 

Mr. FOLEY. I believe that is correct. Yes. 

Mr. DENHAM. What are we going to do with the rest of that 
property? 

Mr. FOLEY. The Woodlawn campus has multiple SSA facilities 
on it, you know, as far as the operations there. But we have an op- 
erations center that we have just recently completed a major ren- 
ovation on. There is the Altmeyer Building as well. 

And so there are multiple other uses for the SSA headquarters. 
We are utilizing the site in a multiple of capacities. We are, as Mr. 
Croft said, in the master planning 

Mr. DENHAM. Is it 100 percent utilized? 

Mr. FOLEY. I believe so, yes. 

Mr. DENHAM. 260 acres, no vacant land out there? 

Mr. FOLEY. Oh, there is additional land. 

Mr. DENHAM. So it is not 100 percent utilized? 

Mr. FOLEY. The buildings themselves are, yes. But there is ad- 
ditional land. 

Mr. DENHAM. And what are we doing with the land? 

Mr. FOLEY. Right now, I mean, it is just buffer area around the 
campus. 

Mr. DENHAM. Could it be utilized for something other than 
buffer? 

Mr. FOLEY. As a part of the study, one of the things we did look 
at was the ability to build on some of these portions. The topog- 
raphy and other things create some challenges. But as a part of the 
master plan, we will be looking at how we can better utilize the 
facility and the possibility for future growth and expansion of SSA 
at the Woodlawn campus. 

Mr. DENHAM. Are there houses on that property? 

Mr. FOLEY. I believe there are. 

Mr. DENHAM. Individual dwellings? 

Mr. FOLEY. I believe there are contiguous 
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Mr. DENHAM. I believe there are, too. Any reason why we 
couldn’t utilize the rest of the 260 acres to develop that area, put 
houses on there, and sell it off to some private developer that may 
be able to provide housing for that community? 

Mr. CROFT. Well, part of the issue, Congressman — and we 
would love to have you come out to the campus if you want to look 
at it. 

Mr. DENHAM. I would love to visit. 

Mr. CROFT. A lot of it is parking, parking lots and so on. 

Mr. DENHAM. 260 acres of parking lots? 

Mr. CROFT. But there is also quite a lot of woodland area. But 
a lot of that has been buffer around the computer center, the Na- 
tional Computer Center. 

Mr. DENHAM. But we are now moving the computer center. 
Correct? So we would not need the large buffer zone, and we would 
be able to develop that property, sell the property off. I am curious 
of what the timeline is to sell the property and to better utilize the 
existing facilities. 

It is also my understanding that a number of the facilities on 
there we lease from private individuals for SSA. Correct? 

Mr. CROFT. Not on the campus, no. 

Mr. DENHAM. Obviously, which is even a bigger problem. We 
are leasing property outside of the campus even though we have 
got 260 vacant acres there. We are leasing property. Are we going 
to now move those individuals into the location that we are moving 
out of once the tenant improvements are done? 

Mr. FOLEY. That is part of the master planning process. So we 
are looking at the best way to accommodate the overall needs on 
the site. 

Mr. DENHAM. I would like to take a look at the entire plan and 
have that available to our committee. My assumption is that we 
are not going to fully utilize the 260 acres, so I would like to see 
what the opportunities would be to sell off that property and what 
it could be used for. 

And then finally, I am assuming 

Chairman JOHNSON. I would like for you to respond to both 
committees in that regard, please. 

Mr. DENHAM. Thank you. 

Contingency on the overall project, I assume, is 10 percent con- 
tingency? 

Mr. FOLEY. I believe so, yes. 

Mr. DENHAM. So $50 million, there could be an opportunity to 
reprogram $50 million, assuming you come in on budget. 

Mr. FOLEY. At the end of the process, yes. 

Mr. DENHAM. Just as a statement, it is my understanding that 
in the past, when money is reprogrammed, it does not always go 
back through this committee, even though you have the obligation 
to bring it before this committee. This committee will make sure 
that we follow up on every project to make sure that every contin- 
gency comes through this committee as well as Appropriations. 

Thank you for my time. 

Chairman JOHNSON. Thank you, sir. I appreciate the question. 

And thank you all for your presence here today and your com- 
ments. Thank you all, and the subcommittees will continue to mon- 
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itor your progress, both of us, to make sure the project is done 
right, within budget, and completed on time, if not ahead of time. 

I appreciate all of my members who joined us. At this time, the 
committee stands adjourned. 

[Whereupon, at 11:34 a.m., the subcommittees were adjourned.] 
[Questions for the record follow:] 


SSA National Support Center: Questions for the Record 

1. What specific controls has the GSA built into the process to prevent further 
delays and stay within budget for the National Support Center? 

GSA has implemented several controls designed to reduce the risk of further delays 
and exceeding the project budget and will continue to mitigate schedule and cost 
risks through the design/construction delivery. 

Scope Management: GSA worked closely with SSA to prepare a thorough Program 
of Requirements (POR) that outlines the scope of the project to ensure SSA’s 
requirements will be met with the completed project. GSA involved industry 
recognized data center experts in the development of the POR and compared its 
cost estimates to the baseline budget set by the feasibility study, as well as industry 
cost benchmarks. GSA will use a change management plan in the design and 
construction phases to include a detailed schedule and cost impact analysis prior to 
approval of potential changes. 

Construction Management: To ensure continuity among the POR, design, and 
construction, GSA will exercise a negotiated option to provide construction 
management (CM) services with the same firm that worked with the SSA and GSA 
to develop the POR. This firm, Jacobs Project Management Company of Arlington, 
Virginia, will be involved with design reviews to ensure the requirements stipulated in 
the POR are met. The contractor will employ a dedicated staff of construction 
experts located at the construction site to monitor the design/builder's performance 
on a daily basis and will notify the GSA Project Manager and Contracting Officer 
upon discovering any deficiencies. GSA will include a detailed schedule of 
requirements as part of the design/build contract, and the CM will help enforce these 
requirements. GSA also has stipulated government review times in the overall 
project schedule and the contract’s Statement of Work to help manage the 
timeframes for government decision making. The contractor, the construction 
manager, and GSA will use diagnostic and analytical tools throughout 
design/construction to track and manage the project budget and schedule. 

Design/Build Contract: GSA chose a design-build delivery approach to minimize 
risks related to design and construction coordination by having a single point of 
accountability for both components. This delivery method will allow for early phases 
of construction and long lead equipment orders to commence in advance of the full 
design completion. To ensure a high quality design/build contractor is hired, GSA is 
using a two-phased source selection approach in which contractors are evaluated 
based on past performance on similar data center projects as well as on their price 
proposal. 


Page 1 of 3 
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By using these controls, GSA is confident we can prevent cost overruns and further 
delays. However, there may be unforeseen risks that are beyond GSA or SSA's 
control. One such risk is potential protests to the award of the design/build contract. 
GSA has built time into the procurement schedule to allow for more detailed reviews 
of the contract file to help eliminate schedule and cost risks associated with a 
potential protest. 

2. How much of the American Recovery and Reinvestment Act of 2009 funding 
has been spent to date? What additional funds will be spent before the end of 
the fiscal year and for what purposes? 

As of March 18, 201 1 , SSA has obligated $385,881 ,201 to GSA in reimbursable 
work agreements (RWAs). 

As of April 8, 201 1 , GSA has obligated $3.7 million and outlayed $3.2 million from 
those RWAs.. GSA anticipates site acquisition by September 2011, with costs 
totaling approximately $25,000,000 for acquisition and related costs. 


3. What are GSA's latest projections for how much the building is going to cost 
and will the cost come in under budget? 

The budget for design, construction, and site acquisition is approximately $400 
million. GSA's projections are still on target to complete the project within that 
budget. 

4. In Mr. Foley's written testimony, he referenced future expansions of the 
Woodlawn campus. Please explain what expansion this refers to and provide 
all related details as to content, timelines, and planning. 

Mr. Foley stated during his testimony: 

“Though GSA and SSA remain committed to the presence of SSA at the Woodlawn 
campus for current mission needs and future expansions, the study showed that the 
National Support Center would be better served at a new site, where risk and cost 
would be minimized and construction could be completed more quickly." 

GSA and SSA remain committed to the presence of SSA at the Woodlawn campus. 
We are looking for opportunities to bring SSA functions currently in leased space to 
the Woodlawn campus. To the extent that there could be new future requirements to 
SSA’s mission that warrant increases in space, GSA will first look for ways to locate 
those requirements on the Woodlawn campus rather than in privately owned leased 
space. 
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5. What is the status of the Social Security Administration (SSA 's) Master 
Planning Process that the GSA is working with the SSA to complete? Please 
provide all related details as to content, timelines, and planning. 

GSA's real estate portfolio strategy for the Woodlawn SSA Campus has focused on 
phased building renovations to meet SSA’s long-term facility needs. In addition to 
the federally-owned facilities located at Woodlawn, SSA also occupies considerable 
leased space in the Woodlawn area. Co-location of some of these leased office 
functions onto the campus is one of the housing solutions that will be evaluated as 
part of an upcoming master plan study of the SSA government-owned campus, 
either through construction of new office space, or through more efficient use of 
existing space. The master plan study also will provide a planning roadmap for 
needed rehabilitation of the buildings on campus. 

In general, the master planning process has two phases. The first phase was a 
housing and leasing study that analyzed the owned and leased SSA building 
inventory and assessed the potential growth in SSA’s mission and facilities needs. 
That study was completed in February 201 1 . 

The second phase of the process is the master plan study. The master plan study 
will further evaluate future SSA headquarters requirements and devise conceptual 
housing solutions to meet those requirements. The evaluation will explore various 
housing alternatives, including new space and consolidation of leased space. The 
Woodlawn campus contains areas of developable land that has the potential to 
support a future SSA need. GSA has begun scoping and developing the 
requirements and plans to begin the procurement process for the master plan study 
this summer. We anticipate the master plan study to be completed by early 2013. 

Concurrent with the master plan, a feasibility study will also be undertaken to 
analyze the condition and potential future use of the existing National Computing 
Center (NCC). This feasibility study will evaluate the repair and alteration 
requirements needed to continue housing the non-data center functions that will 
remain in the NCC building after completion of the new Data Center (NSC) and how 
the vacated space can best be reused by SSA after the IT functions in that building 
are relocated to the new NSC. 
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SOCIAL SECURITY 

Office of Systems 


March 3 1, 201 1 


The Honorable Sam Johnson 
Chairman, Subcommittee on 
Social Security 

Committee on Ways and Means 
House of Representatives 
Washington, D.C. 20515 

Dear Mr. Johnson: 


Commissioner Aslrue has asked me to respond to your March 10, 201 1 letter requesting 
additional information to complete the record for the hearing held on February 1 1 , 20 1 1 , 
Managing Costs and Mitigating Delays in the Building of Social Security s New National 
Computer Center. Enclosed is our response to your questions. 

I hope this information is helpful. If we may be of further assistance to you or your staff, please 
do not hesitate to contact Scott Frey, Deputy Commissioner for Legislation and Congressional 
Affairs, at (202) 358-6030. 

1 am sending a similar letter to Representative Jeff Denham. 


Sincerely, 



Deputy Commissioner 


Enclosure 


SOCIAL SECURITY ADMINISTRATION BALTIMORE. MD 21235-0001 
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Enclosure - Page 1 - The Honorable Sam Johnson 


MAJORITY QUESTIONS FOR THE RECORD 


1. What specific controls has the SSA built into the process to prevent further delays and 
stay within budget for the National Support Center? 

We regularly confer with the General Services Administration (GSA) on each step of the 
building process. Our principal control to ensure timely performance within budget is to 
thoroughly research and consider the requirements for the new facility, and complete those 
tasks on time. However, please note that GSA is responsible for timely project completion. 
We defer to GSA for further description of the controls it has established or plans to establish 
for the project. 

2. IIow much of the American Recovery and Reinvestment Act of 2009 funding has been 
spent to date? What additional funds will be spent before the end of the fiscal year and 
for what purpose? 

As of March 18, 2011, we have obligated S385.881.201 and outlaid $2,954,741. GSA will 
report separately those outlays it will spend during the rest of the fiscal year (FY) and its 
purpose. We also intend to spend additional funds on Information Technology (IT) activities 
in FY 201 1 . We hope to have precise information on the IT expenditures in the next 60 days. 

3. The Commissioner has an advisory group of information technology experts know n as 
the Future Systems Technology Advisory Panel. W'hat recommendation has the panel 
made regarding the building of the new data support center and w hat actions has the 
SSA taken in response? 

At the Commissioner's request, the Future Systems Technology Advisory Panel (FSTAP) 
conducted a high-level review of our plans to replace the National Computer Center. FSTAP 
examined the physical and technological considerations related to the project, as well as the 
planning assumptions for workload capacity and risk management. In January 2010, FSTAP 
issued a report of its findings, entitled Data Center Migration. (See attachment 1) 

Some of FSTAP's major recommendations for minimizing operational risks until the 
National Support Center (NSC) is complete included developing robust contingency plans in 
the event of future construction delays, utilizing virtualization at the National Computer 
Center, and installing new applications and equipment at the Second Support Center. 

FSTAP also made recommendations for the NSC itself, such as utilizing “green” data center 
technologies only where there arc tangible energy savings or substantial cost avoidance 
opportunities. 

We generally concurred with FSTAP's comments, observations, and recommendations. On 
May 4, 2010, we provided our feedback to the FSTAP report at a meeting open to the public 
in Philadelphia, Pennsylvania. For more information, please find attached the full FSTAP 
report and minutes from the May 4, 2010 meeting. These documents are also publicly 
accessible on the Internet at www.ssa.gov/fstap . (See attachment 2) 
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4. In his written statement, Mr. Foley from the General Services Administration 
referenced future expansions of the SSA's Woodlawn campus. What expansion is he 
referring to? Please provide all planning documents that detail these plans. 

Over the years, GSA has worked with us to develop and periodically update a master housing 
plan for the Woodlawn campus. The current plan is outdated. In consultation with us, GSA 
is currently in the process of developing a new master housing plan. We would be glad to 
provide the Subcommittees the new master housing plan when it is complete. 

5. In his testimony before the Subcommittee on Social Security in 2009, Mr. Gallagher 
included a chart outlining disaster recovery capability and timeline. Please provide a 
similar updated chart with as much detail as possible. 

NCC Disaster Recovery Capability Timeline 
(Updated March 2011) 


Timeframe 

Location 

Data 

Restore 

Data 

Loss 

All Critical 
Systems 

Ability to Recover 
All Non-Critical 
Systems 

Capacity for Dail 
Transactions 

Pre -2010 

SunGard 

7 days 

1-3 

days 

No 

No 

25-30% 

1/2010 

ssc 

7 days 

1-3 

days 

Yes 

No 

100% 

Current 

ssc 

4 days 1 

1-3 

days 

Yes 

Yes 5 

100% 

10/2012 

ssc 

24 hours 2 

1 hour 
or less 

Yes 

Yes 5 

100% 


' The 4-day recovery time applies to critical systems only. 

2 The 24-hour recovery time applies to critical systems only. 

5 Presently, we have the data center infrastructure (computing space, electrical power, and HVAC) to 
recover all non-critical systems and process 100% of their daily transactions but we do not have the 
necessary IT equipment. Procurement and installation of the necessary IT equipment to support non- 
critical systems will begin after critical systems are up and running. 


Attachments (2) 

Attachment 1 - FSTAP report, entitled Data Center Migration 
Attachment 2 - FSTAP report and minutes from the May 4, 2010 meeting 
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FUTURE SYSTEMS TECHNOLOGY ADVISORY PANEL (FSTAP) 
“DATA CENTER MIGRATION” 

Report 
January 2010 


Introduction 

The Commissioner of Social Security asked the panel to conduct a high level review of the 
agency's plans to replace the current National Computer Center located on the main campus 
in Baltimore, Maryland. He asked that the panel examine the physical, and technological, 
considerations, as well as the planning assumptions for workload capacity and risk 
management. This report is a result of briefings made to the FSTAP members by SSA, 

GSA, and contractor personnel involved in the planning stage of the project; a review of 
reports and discussions on anticipated workload trends; and deliberations of the FSTAP 
subcommittee on the Data Center Migration, and the review and approval by the members of 
the full FSTAP panel. 

The panel makes the following recommendations based on their knowledge, expertise and 
experience in the areas of information technology, large scale project management planning 
and oversight and data center construction. 

Commissioner’s Concerns with Existing NCC Architecture 

The existing NCC is nearing 30 years in age. Although state of the an at the time, today this 
facility is severely limited as to the amount of power that can be distributed to each floor. 

SSA received Congressional funding ($500 million) to construct a new National Computer 
Center (NCC) and in partnership with GSA, SSA is planning to construct it and have it 
operational by 2014. However, with current workload growth rates SSA projects it will run 
out of electrical distribution capacity in approximately 2012. Unless SSA takes some 
remedial action, SSA will be unable to add more computer processing capacity to handle 
their increasing workloads. 

Commissioner's Scone of Recommendations to be addressed hv the FSTAP 

1 . Other than building renovations to upgrade the existing NCC, what other 
recommendations and viable options can the panel offer as to how the agency can 
remain operational and efficiently support the increased IT demands during the period 
from 2012 until 2014? How can SSA bridge the gap and minimize the risks until the 
new building is operational? 

2. What recommendations can the panel offer so that SSA avoids mistakes other 
organizations have made in planning for a data center replacement? What are the best 
strategies and options to make a computer center flexible to accommodate future 
technologies, new business processes, and workload growth? 


1 
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3. If the panel has additional recommendations they would like to make that are not 
included in items 1 and 2, the Commissioner asked that the panel provide them as 
well. 


FSTAP’s Observations and Suggestions Regarding the NCC 

1. How can SSA bridge the gap and minimize the risks until the new building is 

operational - Recommendations to maintain operability and efficiency from 2012 - 

2014. 

• The development of robust contingency plans is essential. This contingency 
planning should encompass the potential for delays in the construction of the new 
facility and ensure that no existing programs or planned programs are impaired 
during the gap from 2012-2014, or while the agency is migrating from the current 
NCC to the new NCC. The agency should assess the possible pitfalls, delays and 
identify “worst-case scenarios” with the appropriate mitigation actions to be taken 
for each. The agency should have these recovery plans in place should any one of 
the possibilities occur and be ready to execute them. 

• The adoption of increased virtual computing environments to save space and 
power are strongly encouraged. 

• New applications anchor equipment should be installed in the Durham Center 
where possible. 

• The agency should examine their applications portfolio with the goal of 
determining potential candidates for retirement or outsourcing. 

• Create a master project plan for the data center initiative. This plait should reflect 
critical path milestones needed to meet dependencies of all the other major IT 
initiatives underway concurrent with the data center project. 

2. What recommendations can the panel offer so that SSA avoids mistakes other 

organizations have made in planning for data center replacement? 

Recommendations based on Best Practices - Panel Experience 

• “Cloud computing” is useful for certain business applications, however, at this 
state we do not believe the agency should deploy any mission-critical applications 
to a public “cloud computing” platform. 

• We encourage the agency to examine a Software-as-a-Service offering for its 
email needs. 

• Data Center Design and Construction 

a. Plan for hot/cold aisles and “in-row” water cooling. 

b. Eliminate disk storage in servers; storage area networks are more robust 
and space efficient. 


2 
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• "Green” Data Center Technologies 

a. These should be considered only where there are tangible energy savings 
or substantial cost avoidance opportunities. 

i. Consider the use of cheaper power sources that may be available in 
some geographic locations. 

ii. Utilize Plate heat exchangers to exploit more efficient use of 
ambient air temperature. 

• New Data Center Operating Concepts 

a. Consider having an extremely limited staff in the center. We recommend 
the provision of adequate space for emergency IT staff that may need to 
locate there in the event a disaster situation occurs. 

b. The location of the command center for the new NCC can be housed at a 
dilferent geographic location. This can provide security and labor cost 
benefits. Remote access technologies are sufficiently mature for this to be 
undertaken. 

3. Additional Recommendations for the New Data Center Initiative and IT 
• Strengthen overall plans 

a. Establish one organizational owner responsible for the execution of all the 
IT activities associated with this project. 

b. Align the overall strategic plan for the agency with the different IT 
activities that are in process or contemplated. 

c. The agency’s business plan should ensure that each of the IT programs 
supports and delivers the capabilities the agency plans to provide to the 
public and other stakeholders 

d. Identify a single technology executive in the agency who is accountable 
for alignment and execution of all of the IT functions. 

e. Factor in plans to expand and increase capacity for growth, to 
process larger workloads, and advances in technology. 

f. Ensure continuity-of-fimding remains once the project begins. 

Determine how the agency will handle and plan for cost overruns. 

g. Align all government organizations involved in the new NCC 
construction project activities with the agency’s overall business 
goals. Determine and agree on who is responsible for each aspect 
of the project, schedule, and outcome. 

h. Plan for potential loss of key personnel and staff retirement by 
creating succession plans for a smooth transition without any gaps 
in knowledge. 

i. Constantly oversee contract expirations and key vendor 
renegotiations which may impede the schedule, change resources 
or increase costs 


3 
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• Assessing costs and estimates 

a. Examine benchmark data to determine how the planned data center costs 
compare to similar Tier 3, Level 4/5 security data centers elsewhere in 
government. Also consider comparisons to comparable private sector projects. 

b. Reconcile project cost differences between the Lockheed-Martin and 
GSA studies. These should be normalized for: 

i. Additional security measures 

ii. "Buy American” 

iii. Use of union labor sources 

iv. LEEDS certification 

c. Strive to accelerate land acquisition to capitalize on current "buyers 
market”. 

d The new' location should take into account factors such as: 

i. sources for power and telecommunications infrastructure 

ii. Avoidance of 1-95 and DC metro area traffic congestion 

iii. Distance limitations associated with certain technology components 

(e.g., synchronous disk mirroring, etc.) 

iv. Power needs of the future may exceed the 13,200v feeder 
capacity currently under consideration 

3. Long-Range Issues for Data Center Planning 

• Selecting a viable number of enterprise Data Centers 

a. Reduce the need for space by exporting some “compartmentalize-able” 
applications. Buy a managed service application where possible, instead 
of adding equipment capacity at the NCC. Data privacy is a crucial factor 
to the applicability of this approach. 

b. Develop the Data Center with a clear link between the agency’s business 
plan and growth drivers. 

c. A "hot-site” may still apply in multi-data center environments. 

• Life span of Data Center 

a. The lifecycle of the new NCC should encompass a horizon of 
20+ years. 

b. The upgrade or expansion of computer equipment should have as 
one of its goals the reduction of floor space, and the use of this 
space capacity for other purposes. 

• The decision making consideration for future technology should consider 5 years as 
the normal limit of usable forecasts. 

a. The agency should work with key vendors to obtain non-disclosure 
briefings on their product and service roadmaps. 


4 
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Future Systems Technology Advisory Panel 

May 4, 2010 
Hotel Palomar 

117 South 17“' St, Philadelphia. PA 19103 


Minutes 

1 . The Future Systems Technology Advisory Panel held its seventh meeting on May 4, 
2010 from 9:00 A M. to 4:00 P M. in the Burnham Ballroom of the Hotel Palomar in 
Philadelphia, PA . The meeting was open to the public from 9:00 A M. to 4:00 P.M.. 

2. Attendees included: 

a. Future Systems Technology Advisory Panel members 

• Alan Balutis. Panel Chair and Director of the North American Public 
Sector. Cisco Systems' Business Solutions Group 

• Phil Becker, Associate Commissioner for the Office of 
Telecommunications and Systems Operations, Social Security 
Administration 

• Andy Buckler, Special Advisor to the Deputy Commissioner Services 
& Enforcement, Internal Revenue Service 

• Gregory E. Buoncontri, Executive Vice President and CIO, Pitney 
Bowes, Inc. 

• John D. Halamka, MD, MS, Harvard University, CIO, Harvard 
Medical School. CIO, Beth Israel Deaconess Medical Center. Dr 
Halamka was available by telephone only. 

• Blaise Heltai. Founder, Genus2 Technology 

• Henry C. Lucas, Jr., Department Chair and Smith Professor of 
Information Systems, University of Maryland 

• David McClure, Associate Administrator, Citizen Services and 
Communications, U S. General Services Administration 

• CJ Moses. Senior Manager. Amazon Web Services.. 

• Frank Reeder. Founder, The Reeder Group. 

• Steve Sullivan. Vice President of Global Technology Services, T. 
Rowe Price Group, Inc. 


b Social Security Administration Officials 

• Michael J. Astrue, Commissioner of Social Security 

• Frank Baitman, Chief Information Officer 

• Betsy Bake, Associate Commissioner, Office of Facilities 
Management 

• Jim Borland, Associate Commissioner, Office of Electronic 
Serviceand Strategic Information, Office of Disability Adjudication and 
Review 

• Kelly Croft, Deputy Commissioner, Office of Systems 

• Ephraim Feig, Associate Chief Information Officer for Vision and 
Strategy 
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• David Foster, Assistant Deputy Commissioner for Quality 
Performance 

• Michael Gallagher, Deputy Commissioner for Budget, Finance, and 
Management 

• Eric Kressman. Regional Chief Counsel. Philadelphia 

• William Martinez, Deputy to the Special Advisor for Health 
Information Technology 

• Greg Pace, Deputy Chief Information Officer 

• Ron Raborg, Deputy Commissioner for Quality Performance 

• Debbi Russell, Associate Commissioner, Office of Automation 
Support 

c. Social Security Administration Staff 

• Ginny Skiest for Dianne Rose, Designated Federal Officer (DFO) 

• Devin Fensterheim, Hardy-Apfel IT Fellow 

d. Members of the Public who presented oral or written statements 

• None 

e Other members of the public 

• Several members of the public attended the meeting 


3. Description of matters: 

Tuesday, May 4, 2010 

a Meeting Kick-Off : Alan Balutis, panel Chairman, made welcoming remarks. 

Panel members and SSA officials introduced themselves 

Ginny Skiest introduced herself and members of the panel support staff. She 
discussed the meeting agenda, completed action items, and documents provided to 
the Panel. 

The panel unanimously approved the meeting minutes of the sixth panel meeting. 

b. Data Center Migration Report and Data Center Trends and Best Practices 
Discussion - Agency Feedback was presented by Frank Baitman. Kelly Croft. 
Michael Gallagher, and Betsy Bake. 

The panel heard the agency response to the Panel's report on data migration The 
agency generally concurred with the panel's comments, observations, and 
recommendations. 

The panel heard, as background information, that SSA's existing data center will 
soon need replacement, and that there is a need to continue operations at the 
existing data center through the anticipated production date of the new center in 
2015. The agency is retrofitting the existing center to bridge this gap, for instance, 
by purchasing spare parts for the uninterrupted power supply system . There is also 
a need for additional data consumption: an additional servers are added each month, 
resulting in power delivery becoming an issue. 
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The panel heard that the agency strongly agrees with the panel's recommendation 
for hardware virtualization, and it heard that the agency has an active virtualization 
plan. The agency also agreed with the panel's recommendation that hardware 
refreshment be focused primarily at the second site while refreshment at the existing 
NCC is minimized. 

The agency indicated that the panel s recommendation for application portfolio 
management could warrant future requests to the Panel. SSA maintains over 500 
production legacy applications, and has an existing process to manage the portfolio 
and to evaluate business value and maintenance costs. The panel heard that the 
process of developing the portfolio and preventing migration of unneeded 
applications is expected to be an ongoing process and that it may be an area in 
which the agency may seek future support. The panel also heard about the 
revamped IT investment process which produced SITAR (Strategic IT Assessment 
and Review). SITAR was designed to develop more strategic IT investment, and it 
divides IT investment among eight Portfolios Executives across the enterprise. The 
panel heard that analysis indicates that over 40% of IT spending is used on 
maintenance activity. The agency said that this is an area of concern that the SITAR 
process will be used to address. 

The panel heard the agency concurs with the recommendation to limit the number of 
staff in the new data center. Mr. Buoncontri indicated that the agency utilize remote 
access to the data center Mr. Moses concurred, indicating that legacy systems may 
require a higher onsite workforce, that office space is much less expensive than data 
center space, and that data centers are generally unmanned except when access to 
hardware is needed. Mr. Buoncontri recommended that the agency choose a 
staffing target and adhere to that limit. 

The panel heard the agency's response to observations from the panel regarding the 
silo nature of the business approach. This response indicated that the agency 
endeavors, through the SITAR process, to move from a silo to a matrix management 
approach in order to increase accountability. The panel heard that the SITAR 
process involves making investments that span the enterprise and represent the 
correct investments for the entire agency. 

The agency updated the panel on the data center acquisition and reported that the 
agency is currently engaged with GSA to build a program of requirements for award 
of the contract. The agency indicated that the recommendation that one person be 
in charge has great appeal. The agency reported that SSA and GSA meet quarterly 
with Congressional staff, and that SSA takes questions and responds quickly to 
Congressional inquiries. 

The agency reported initial plans to move certain workloads to the cloud to realize 
the resulting process efficiency. E-mail was suggested as a potential initial cloud- 
based application The panel heard that the agency would consider placing 
additional applications in the cloud, but that doing so requires a baseline for risk 
assessment. Several panel members offered feedback, indicating that while 
responsibility is transferred, risk is not, and that due diligence in selecting a provider 
is necessary. 
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Mr. Gallagher indicated that power consumption is a concern, and asked the panel 
for additional recommendations. The panel discussed mechanisms for reducing 
power consumption, including running the data center at a higher temperature, 
placement of hardware in separate rooms in contrast to a large open space, and 
reducing unnecessary code Mr Buoncontri offered to coordinate further 
discussion on this topic. 


c. Data Center Construction - A First-hand Experience was presented by panel 
member Steve Sullivan. 

Mr. Sullivan presented on T Rowe Price's experiences in the construction of a data 
center for disaster recovery of about 350 applications. The data center is a 60,000 
square-foot facility including two separate 10,000 square-foot data centers 

The panel heard that T Rowe Price was experiencing several of the issues in the 
disaster recovery space as SSA is experiencing in its primary space, including power 
supply and data center space issues. The panel heard that outsourcing and co- 
location were considered as possibilities; the costs for co-location or keeping the 
data center inside were about equal, and the firm decided to maintain control. 

The panel heard that the selected location met the distance and infrastructure 
requirements. . 

The panel heard that T Rowe Price engaged in a nine-month site selection process. 
Verizon was contracted to evaluate the site and to evaluate risks. The site was 
ultimately selected due to available infrastructure, low risk of natural or human 
disasters, carrier coverage, and proximity to the production site 

The panel saw a series of photographs documenting the construction of the data 
center between July, 2009 and April, 2010. 

d Re-lmaainina SSA Subcommittee Report was presented by panel member Henry 
Lucas. 

Dr Lucas presented the findings of the Re-Imagining SSA Subcommittee. The 
subcommittee used a scenario from SSA on agency processes, and attempted to 
imagine that process in a different environment The subcommittee attempted to 
develop a sufficiently radical report and to push frontiers, to effect observable 
change 

The subcommittee recommended that online customer service model be the primary 
interaction channel for most of the US population. The panel heard that where there 
are many fewer points of face-to-face contact, such transition requires a major 
change in the organization itself. The subcommittee recommended moving away 
from paradigm where we serve people by meeting face-to-face, and presented the 
objective that 90% of all service transactions be completed electronically by 2015. 

Mr. Buckler indicated that IRS electronic filing, introduced in 1990, is currently about 
70% and expressed concern that the 90% goal is too high. 

Commissioner Astrue indicated that there is something to be said for a difficult goal, 
and that currently 80% of people are using electronic wage reporting, and direct 



deposit transactions may increase significantly with upcoming treasury initiatives. 

The Commissioner indicated that the agency is likely to make major transactions 
accessible on line and then set objectives that are aggressive but achievable. The 
agency is also engaged in cost effective advertising campaigns to advertise suites of 
services that encourage family members to help those needing access to SSA 
services. 

Mr. Reeder expressed fundamental concern speaking of service delivery as though 
there is an expectation that people come to SSA as opposed to reaching out to the 
customer. Mr Reeder indicated that it is counter-intuitive that people would come to 
SSA for a once-in-a-lifetime transaction, and argued that it would not be possible to 
exceed 20% without utilizing different channels including the nation's financial 
infrastructure. 

Dr. Lucas reported that the use of HIT is very promising in reducing the length of 
time to process a disability claim. The panel learned earlier that MetLife uses a 
program to automatically determine disability, and reviews only the denials. 
Commissioner Astrue said that electronic records are problematic since they produce 
a significant number of false positives from 2.2 million filings; for instance, the text 
We ruled out ALS" might be recorded erroneously as ALS. 

Dr. Lucas recommended that all applications need to be accessible on cell phones. 
Mr. Astrue said that some third world nations are issuing payment through cell 
phones as an alternative for those who don't have traditional bank accounts. 

Dr. Lucas proposed the implementation of a physical one-stop shop for government 
services, similar to the Australian CentreLink, which could use video kiosks and 
involve multiple state and federal agencies. Mr Buckler indicated that the costs to 
maintain video kiosks are excessive, and instead organizations typically place 
workstations in walk-in office, encouraging customers to use web-based services. 
IRS has worked through volunteer organizations for tax preparation, and can 
consider such organizations as an extension of the workforce; and that while kiosks 
in public areas are appealing, physical security, maintenance, telecommunications, 
and information security issues tend to make this approach infeasible. 

Commissioner Astrue also noted that kiosks tend to not be used, and indicated as an 
example an unused kiosk observed in a Seattle field office waiting room that had not 
been used for several weeks. Dr. Lucas suggested that the waiting-room population 
might be self-selected, and that the agency may have skimmed out the kiosk-using 
population 

The panel heard discussion of disruptive future technologies. Dr. Lucas reported 
that a single breakthrough to eliminate the backlog was unlikely, and suggested the 
move to the Internet for as many transactions as possible and to utilize third parties. 

Mr. Balutis suggested some minor changes and additional research on the use of 
mobile devices. Mr. Heltai and Mr. Balutis volunteered to provide assistance. 
Contingent on these final modifications, the panel unanimously accepted the report. 


Legacy Systems Subcommittee Report was presented by panel member Andy 
Buckler. 



70 


Mr. Buckler provided a summary of the subcommittee report. The subcommittee 
discussed the transfer from MADAM to DB2, and found mainframe based DB2 to be 
a reasonable technology solution. 

The subcommittee suggested that the Agency bring in outside help to ensure the 
robustness of the data model. The subcommittee also made suggestions around the 
planning process in aligning the business strategy with application process, and 
found the SITAR process to be consistent with these recommendations. 

The Panel approved the report without objection. 

f. Privacy, Authentication, and Fraud Detection Subcommittee Update was presented 
by panel member Frank Reeder 

Mr. Reeder provided a summary of the draft subcommittee report. The 
subcommittee reported that the ability to move from face-to-face to electronic access 
is important, and that the agency is constrained by two sets of concerns: the 
necessary authentication methods through the National Institute of Science and 
Technology, and a very low tolerance for risk from both a financial and reputational 
standpoint 

The panel heard that the Agency has developed an authentication strategy The 
agency is in the process of implementing a solution for Level-3 authentication. The 
subcommittee found that the strategy, based on its observations, is sound. 

Mr. Reeder reported that the subcommittee's main concern was from a reputational 
risk perspective, and recommended a more extensive consultation with affected 
groups from a privacy and usability perspective. 

The panel heard that the agency had expressed an interest in having the views of 
the Panel on alternative means to provide Level-3 credentials. Mr Reeder asked the 
panel for additional thoughts on balancing the need for authentication while 
simultaneously achieving the agency objectives for electronic sen/ices usage. 

Mr. Moses expressed concern that the proposed use of credit card validation would 
subject the Agency to payment card industry security standard certification, and 
recommended against its use. 

Mr Balutis inquired about earlier efforts to implement a government-wide PKI 
solution. Mr. McClure reported that this effort is ongoing that there is some 
consensus around a federal PKI standard. 

The panel discussed whether to appoint panel members with experience and 
background in this area. Mr. Baitman agreed to work with the panel to identify the 
exact nature of the request. 

The subcommittee agreed to finalize the report and present a final copy to the panel 
at the next quarterly meeting 
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g. Marketing Online Services to a Spanish-Speaking Population - Follow-up was 
presented by Devin Fensterheim, Hardy-Apfel IT Fellow, SSA. 

The panel heard an historical perspective of this issue and a discussion of guidelines 
and vision as well as an assessment of operational drivers and future challenges. 
The panel also heard discussion of the agency's Retirement Estimator, the use of 
social media, the flexibility of e-services infrastructure. 


h. Disability Backlog and HIT Subcommittee Update was presented by panel members 
Blaise Heltai and John Halamka. 

Mr. Heltai and Dr. Halamka presented an update on the merged Disability Backlog 
and HIT subcommittee. The panel heard that the committee has moved toward 
broader process and governance issues. The panel heard that a paper will be 
delivered at the next quarterly meeting. 

i. Agency-Wide Strategic Planning Status Update was presented bv Frank Baitman 
and Ephraim Feio. 

Mr. Baitman discussed the agency's strategic planning process and the schedule for 
completion of the Agency Strategic Plan The panel heard that the plan, whose 
targeted completion date is December 2010, will envision human resources, 
infrastructure and technology needs over a 5 to 10 year period and that it will include 
achievable, grand challenges as well as the use of metrics and short-term goals. 

Mr. Feig discussed taking action in an evolutionary way to make substantial gains in 
service delivery while reducing the cost of operations. He recommended clearly 
identifiable goals and practical methods. He said that an outreach program will begin 
immediately, stakeholders will be engaged, and that regional meetings and online 
forums will be held. 

Mr. Balutis recommended that the strategic planning process not be schedule driven 
and that it should be created in a very open, collaborative, communicative way that 
includes customers, constituents, citizens and other interested parties. 

Mr. McClure recommended that strategic planning be done in a quick rapid cycle and 
that the results be inculcated in the business planning and governance processes. 

He added that the agency should be rapidly re-engaged 

The panel discussed development of a series of goals and Mr. Baitman asked for the 
panel's advice on metrics which can be used to drive the strategic vision. 


j. New Subcommittee Discussion 

The panel created a subcommittee specifically designated to work with the Office of 
the Chief Information Officer in the area of strategic planning. The panel also 
created a joint subcommittee combining governance and policy with innovation and 
open government. Members were selected for both of these subcommittees. 
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Certification 


I, Dianne Rose, Designated Federal Official for the Future Systems Technology Advisory Panel 
("FSTAP Panel") hereby certify that the above minutes accurately describe the seventh meeting 
of the FSTAP panel, held on May 4, 2010 from 9: 00 A M. to 4: 00 P.M. in the Burnham 
Ballroom of the Hotel Palomar, 117 South St., Philadelphia PA 19103. 


Dianne Rose 





73 



SOCIAL SECURITY 

Office of the Inspector General 
March 21, 2011 


The Honorable Sam Johnson 

Chairman, Subcommittee on Social Security 

Committee on Ways and Means 

House of Representatives 

Washington, D.C. 20515 

Attention: Kim Hildrcd 

Dear Chairman Johnson: 

This is in response to your March 10, 201 1 correspondence asking questions for the record, 
further to my testimony on February 1 1, 201 1 before the Subcommittee on Social Security and 
the Subcommittee on Economic Development, Public Buildings, and Emergency Management, 
Committee on Transportation and Infrastructure, at a joint oversight hearing. Managing Costs 
and Mitigating Delays in the Building of the Social Security Administration 's New National 
Computer Center. I appreciate the opportunity to provide additional information regarding this 
critical issue. Below are responses to your specific questions. 

1. Should the National Computer Center (NCC) fail, do you have any concerns with the 
Second Support Center’s (SSC) ability to run both its workloads and the NCC’s 
workloads at the same time? Has this ability been adequately tested? 

With minor exceptions, we believe the SSC has the ability to run both its workloads and the 
NCC. If the NCC should become unavailable, the SSC can recover all mission-critical 
workloads with the exception of some disability-related workloads. Per SSA, the Agency 
has purchased and configured the equipment to enable it to recover all disability-related 
workloads. Due to budget constraints, SSA has not tested the equipment to date; however, 
the Agency plans to test the equipment as part of its July disaster recovery exercise. 

In our Congressional Response Report: The Social Security Administration 's Disaster 
Recovery Capabilities (A-14-1 1-21138), we stated, "until SSA tests and validates the critical 
NCC applications restored at the SSC at a level of processing that represents the daily 
workload levels of the Agency, there is a risk that the systems will not fully function if the 
NCC is unavailable.” SSA responded that it believes, based on its capacity analysis, there is 
limited risk that the systems will not fully function if the NCC is unavailable. 

2. Please provide your assessment of how the Commissioner is utilizing the Future 
Systems Technology Advisory Panel (FSTAP). Are there recommendations that have 
not been implemented that you think deserve further consideration? 


SOCIAL SECURITY ADMINISTRATION BAL TIMORE. MD 21235-0001 
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Page 2 — The Honorable Sam Johnson 


To date, the Commissioner has asked the FSTAP to conduct various reviews and provide 
recommendations on how the Agency could improve its Information Technology investments 
and operations. The FSTAP has issued four reports since its inception in May 2008: 

• Low Hanging Fruit Quick Victories, September 2009 

• Data Center Migration, January 2010 

• Legacy Systems Conversion Report, May 2010 

• Re-Imaging Social Security, June 2010 

The Commissioner requested three of the four reports. One report. Low Hanging Fruit/Quick 
Victories was a byproduct of initial briefings and site visits to various Social Security offices. 
The FSTAP has made over 50 recommendations or suggestions to SSA to help improve its 
systems and operations. We have not received information from SSA on the status of these 
recommendations. We do agree with most of the recommendations made by the FSTAP and 
believe SSA should develop an appropriate and timely action plan to implement them. 

3. What is your understanding of the controls built into the National Support Center 
project by both the U.S. General Services Administration and the Social Security 
Administration which seek to prevent further delays and make sure the project stays 
within budget? Do you have any concerns with these controls? 

We have not seen the controls built into the National Support Center project; however, we 
plan to review GSA/SSA's contingency planning. At this point, we arc concerned that no 
contingency plan exists to prevent further delays and make sure the project stays within 
budget. 

We are currently negotiating with our contractor to conduct our review, in which we will 1 ) 
determine if SSA has contingency plans to keep the NCC operational until the new data 
center is operational; 2) compare SSA’s contingency plans to industry best practices; and 3) 
make recommendations to resolve weaknesses in SSA’s contingency plans. We plan to 
initiate this review shortly. 

Thank you for the opportunity to clarify these issues for the Subcommittee on Social Security. 1 
trust that I have been responsive to your request. If you have further questions, please feel free 
to contact me, or your staff may contact Misha Kelly, Congressional and Intra-Govemmental 
Liaison, at (202) 358-6319. 


Sincerely, 

Patrick P. O’Carroll, Jr. 
Inspector General 


SOCIAL SECURITY ADMINISTRATION BALTIMORE, MD 2 1 235-0001 
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